CVE-2026-115351 Details
Description
Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.
A CSS injection vulnerability has been identified in Mistune versions 3.2.1 prior to 3.3.0. This vulnerability allows attackers to inject arbitrary style declarations into the rendered output by exploiting the unvalidated 'figwidth' option of the figure directive. When the figure is rendered, the injected styles can include harmful declarations such as 'background:url()', which can lead to data exfiltration by forcing the victim's browser to send requests to attacker-controlled servers.
Users are advised to update to Mistune version 3.3.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lepture/mistune/security/advisories/GHSA-xmwc-wjpr-q378 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/lepture/mistune/security/advisories/GHSA-xmwc-wjpr-q378 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/mistune-3.2.1-before-3.3.0-css-injection-via-figure-directive-figwidth-option | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mistune | <= 3.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |