What’s Vulnerable › Vulnerabilities

CVE-2026-115351: Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-29
• Weakness: CWE-94

Description

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.

Affected products

• lepture mistune: from 3.2.1 before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: lepture mistune 3.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/lepture/mistune/security/advisories/GHSA-xmwc-wjpr-q378
• https://www.vulncheck.com/advisories/mistune-3.2.1-before-3.3.0-css-injection-via-figure-directive-figwidth-option
• https://github.com/lepture/mistune/security/advisories/GHSA-xmwc-wjpr-q378

Get alerted when CVE-2026-115351 or the next vulnerability affects your stack