Описание
Security update for python-mistune
This update for python-mistune fixes the following issues
- CVE-2026-59922: quadratic-time parsing on long runs of some markers in
formatting.pycan lead to DoS (bsc#1271117). - CVE-2026-59923:
HTMLRenderer.safe_url()does not block percent-encoded javascript URIs and allows for XSS (bsc#1271119). - CVE-2026-59924: improper processing of user-supplied include paths in
Include.parse()can lead to path traversal and arbitrary file reads (bsc#1271121). - CVE-2026-59925: quadratic-time parsing on long runs of some emphasis pairs in
inline_parsercan lead to DoS (bsc#1271125). - CVE-2026-59926: improper escaping in
render_admonition()can lead to atribute injection and XSS (bsc#1271127). - CVE-2026-59927: uncontrolled recursion when processing two markdown files that include each other can lead to a DoS (bsc#1271128).
- CVE-2026-59928: quadratic-time parsing on long lists of repeated reference-link definitions in
block_parsercan lead to DoS (bsc#1271131). - CVE-2026-59929: HARMFUL_PROTOCOLS list misses legacy and chained schemes and allow arbitrary script execution in user agents (bsc#1271132).
- CVE-2026-59930: the
tocplugin andTableOfContentsdirective generate heading IDs with predictable values and allow for collisions with attacker-controlledid="toc_N"content (bsc#1271082).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1271082
- SUSE Bug 1271117
- SUSE Bug 1271119
- SUSE Bug 1271121
- SUSE Bug 1271125
- SUSE Bug 1271127
- SUSE Bug 1271128
- SUSE Bug 1271131
- SUSE Bug 1271132
- SUSE CVE CVE-2026-44896 page
- SUSE CVE CVE-2026-59922 page
- SUSE CVE CVE-2026-59923 page
- SUSE CVE CVE-2026-59924 page
- SUSE CVE CVE-2026-59925 page
- SUSE CVE CVE-2026-59926 page
- SUSE CVE CVE-2026-59927 page
- SUSE CVE CVE-2026-59928 page
- SUSE CVE CVE-2026-59929 page
- SUSE CVE CVE-2026-59930 page
Описание
Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used, because these values bypass the inline renderer. Version 3.2.1 contains a patch.
Затронутые продукты
Ссылки
- CVE-2026-44896
- SUSE Bug 1264754
Описание
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
Затронутые продукты
Ссылки
- CVE-2026-59922
- SUSE Bug 1271117
Описание
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version 3.3.0.
Затронутые продукты
Ссылки
- CVE-2026-59923
- SUSE Bug 1271119
Описание
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.
Затронутые продукты
Ссылки
- CVE-2026-59924
- SUSE Bug 1271121
Описание
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.
Затронутые продукты
Ссылки
- CVE-2026-59925
- SUSE Bug 1271125
Описание
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.
Затронутые продукты
Ссылки
- CVE-2026-59926
- SUSE Bug 1271127
Описание
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.
Затронутые продукты
Ссылки
- CVE-2026-59927
- SUSE Bug 1271128
Описание
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.
Затронутые продукты
Ссылки
- CVE-2026-59928
- SUSE Bug 1271131
Описание
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to reach rendered href and src attributes and potentially execute script in affected user agents. This issue is fixed in version 3.3.0.
Затронутые продукты
Ссылки
- CVE-2026-59929
- SUSE Bug 1271132
Описание
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id="toc_N" content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.
Затронутые продукты
Ссылки
- CVE-2026-59930
- SUSE Bug 1271082