Mistune vulnerabilities

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

A path traversal vulnerability in Mistune's opt-in Include directive allows attackers to read local files by supplying relative or absolute include paths. An attacker submitting Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.

Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path traversal, to execute stored scripts when escape=False is set.

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans that stall worker processes for minutes.

Mistune versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from asterisks, and recursive rendering can exceed Python's recursion limit, causing a crash. Fixed in version 3.3.3.

In the Mistune Python Markdown parsing library, a vulnerability was found in the toc plugin and TableOfContents directive. They generate heading IDs as predictable toc_N values without slugifying the heading text, allowing an attacker to inject their own id="toc_N" and collide with generated anchors.

Mistune, a Python Markdown parser, prior to version 3.3.0 has a vulnerability due to insufficient filtering of dangerous URI schemes in href and src attributes. The safe_url filter only blocks javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to reach rendered attributes, potentially enabling script execution in affected user agents.

A vulnerability in the Mistune Python Markdown parser before version 3.3.0 allows a denial of service attack via CPU exhaustion. A Markdown document containing many repeated or distinct reference-link definitions causes quadratic complexity in src/mistune/block_parser.py and the ref_links dictionary handling.

A vulnerability in the Mistune Python Markdown parser before version 3.3.0 allows unbounded recursion via two Markdown files that include each other. This triggers a RecursionError and crashes the rendering process.

In the Mistune Python library, a vulnerability exists due to improper escaping of the :class: option of the Admonition directive before inserting it into the HTML class attribute. This allows attribute injection and XSS attacks even when HTMLRenderer escape mode is enabled. The issue is fixed in version 3.2.1.

Mistune is a Python Markdown parser. Prior to version 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing.

Mistune is a Python Markdown parser. Prior to version 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read().

In the Mistune Python library, a vulnerability exists where HTMLRenderer.safe_url() does not block percent-encoded javascript URIs. This allows an attacker to bypass URL protections in Markdown links or images and execute script in rendered HTML.

A vulnerability in the Mistune Python Markdown parser before version 3.3.0 causes quadratic computational complexity when processing sequences of closed tilde, equals-sign, or caret markers in strikethrough, mark, and insert plugins. An attacker can exploit this to cause CPU exhaustion (denial of service).

Mistune is a Python Markdown parser. Prior to version 3.3.0, it is vulnerable to a CPU exhaustion DoS due to quadratic complexity in the parse_link_text function. Processing many consecutive [ characters causes repeated scanning of input, leading to excessive CPU usage.

Mistune, a Python Markdown parser, prior to 3.2.1 contains a CSS Injection vulnerability in the Image directive plugin. The regex validation for :width: and :height: options only checks for a numeric prefix, allowing arbitrary CSS injection into the style attribute. This can be used for defacement or data theft.

Mistune prior to 3.2.1 contains a Cross-Site Scripting (XSS) vulnerability in render_toc_ul(). The id and text values are inserted into <a> tags without HTML escaping, allowing an attacker to inject arbitrary HTML, including <script> tags, via a crafted heading.

Mistune prior to 3.2.1 contains an HTML Injection vulnerability in HTMLRenderer.heading(). The id attribute value is concatenated directly into the <hN> tag without escaping, allowing an attacker to inject arbitrary attributes such as event handlers, src, href, etc.

Mistune, a Python Markdown parser, up to version 3.2.0 is vulnerable to attribute injection and XSS in the render_figure() function in image.py. The figclass and figwidth options are concatenated directly into HTML attributes without escaping, even with HTMLRenderer(escape=True).

Mistune prior to 3.2.1 contains an HTML Injection vulnerability in the math plugin. Inline and block math content is concatenated directly into HTML output without escaping, even when escape=True is set. This allows injection of arbitrary HTML.

In Mistune versions 3.0.0a1 through 3.2.0, a ReDoS vulnerability exists in the `LINK_TITLE_RE` regular expression. Overlapping alternatives in the regex can cause catastrophic backtracking, leading to high CPU consumption and denial of service when processing crafted Markdown input.