Количество 7
Количество 7
GHSA-8g87-j6q8-g93x
Mistune Math Plugin has an XSS Escape Bypass
CVE-2026-44708
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1.
CVE-2026-44708
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1.
CVE-2026-44708
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1.
CVE-2026-44708
Mistune Math Plugin XSS Escape Bypass
CVE-2026-44708
Mistune is a Python Markdown parser with renderers and plugins. Prior ...
openSUSE-SU-2026:20827-1
Security update for python-mistune
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-8g87-j6q8-g93x Mistune Math Plugin has an XSS Escape Bypass | CVSS3: 6.1 | 0% Низкий | 3 месяца назад |
 | CVE-2026-44708 Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1. | CVSS3: 6.1 | 0% Низкий | 2 месяца назад |
 | CVE-2026-44708 Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1. | CVSS3: 6.1 | 0% Низкий | 2 месяца назад |
 | CVE-2026-44708 Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1. | CVSS3: 6.1 | 0% Низкий | 2 месяца назад |
 | CVE-2026-44708 Mistune Math Plugin XSS Escape Bypass | 0% Низкий | 2 месяца назад | |
| CVE-2026-44708 Mistune is a Python Markdown parser with renderers and plugins. Prior ... | CVSS3: 6.1 | 0% Низкий | 2 месяца назад |
 | openSUSE-SU-2026:20827-1 Security update for python-mistune | 2 месяца назад |
Уязвимостей на страницу