CVE-2026-44896
published 2026-05-26CVE-2026-44896: Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure() function…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.20%
9.8th percentile
Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used, because these values bypass the inline renderer. Version 3.2.1 contains a patch.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lepture | mistune | < 3.2.1 | 3.2.1 |
| mistune_project | mistune | <= 3.2.0 | — |
| mistune_project | mistune | 0 – 3.2.0 | — |
| mta | mta-solution-server-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
lepture mistune up to 3.2.0 Python Markdown Parser image.py render_figure cross site scripting (GHSA-58cw-g322-p94v)
vuldb·2026-05-26·CVSS 5.3
CVE-2026-44896 [MEDIUM] lepture mistune up to 3.2.0 Python Markdown Parser image.py render_figure cross site scripting (GHSA-58cw-g322-p94v)
A vulnerability has been found in lepture mistune up to 3.2.0 and classified as problematic. The impacted element is the function render_figure of the file src/mistune/directives/image.py of the component Python Markdown Parser. Performing a manipulation results in cross site scripting.
This vulnerability was named CVE-2026-44896. The attack may be initiated remotely. There is no available exploit.
GHSA
Mistune has XSS via unescaped figclass/figwidth in Figure directive
ghsa·2026-05-08
CVE-2026-44896 [MEDIUM] CWE-79 Mistune has XSS via unescaped figclass/figwidth in Figure directive
Mistune has XSS via unescaped figclass/figwidth in Figure directive
In `src/mistune/directives/image.py`, the `render_figure()` function concatenates `figclass` and `figwidth` options directly into HTML attributes without escaping (lines 152-168).
This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used, because these values bypass the inline renderer.
Other attributes in the same file (src, alt, style) are properly escaped; figclass/figwidth were missed.
Red Hat
mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes
vendor_redhat·2026-05-26·CVSS 6.1
CVE-2026-44896 [MEDIUM] CWE-79 mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes
mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes
Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used, because these values bypass the inline renderer. Version 3.2.1 contains a patch.
A flaw was found in Mistune, a Python Markdown parser. This vulnerability allows a remote attacker to inject malicious code into web pages, leading to Cross-Site Scripting (XSS). The issue arises from the `render_figure()` function, which improperly handles `figclass` and `figwidth` options by directly embedding t
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-44896 python-mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes [epel-all]
bugzilla·2026-06-23·CVSS 6.1
CVE-2026-44896 [MEDIUM] CVE-2026-44896 python-mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes [epel-all]
CVE-2026-44896 python-mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44896 python-mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes [fedora-all]
bugzilla·2026-06-23·CVSS 6.1
CVE-2026-44896 [MEDIUM] CVE-2026-44896 python-mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes [fedora-all]
CVE-2026-44896 python-mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44896 python-mistune08: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes [epel-all]
bugzilla·2026-06-23·CVSS 6.1
CVE-2026-44896 [MEDIUM] CVE-2026-44896 python-mistune08: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes [epel-all]
CVE-2026-44896 python-mistune08: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44896 mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes
bugzilla·2026-05-26·CVSS 6.1
CVE-2026-44896 [MEDIUM] CVE-2026-44896 mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes
CVE-2026-44896 mistune: Mistune: Cross-Site Scripting (XSS) via unescaped HTML attributes
Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and realier, in src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used, because these values bypass the inline renderer.
2026-05-26
Published