What’s Vulnerable › Vulnerabilities

CVE-2026-59922: Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-08 · updated 2026-10-25
• Weakness: CWE-407

Description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

Affected products

• lepture mistune: before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: lepture mistune 3.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/lepture/mistune/commit/96d0f57f8fe9eeb06bb4cff521962a27d7c402e7
• https://github.com/lepture/mistune/releases/tag/v3.3.0
• https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq
• https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq

Get alerted when CVE-2026-59922 or the next vulnerability affects your stack