CVE-2026-44899 Details
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r"^\d+(?:\.\d*)?"). When the validated value is not a plain integer, render_block_image() inserts it directly into a style="width:...;" or style="height:...;" attribute. Because the value was accepted by the prefix-only regex, any CSS after the leading digits reaches the style= attribute verbatim and without escaping. This vulnerability is fixed in 3.2.1.
A CSS injection vulnerability has been identified in the Image directive plugin of the Mistune Markdown parser, prior to version 3.2.1. The vulnerability arises because the plugin's validation for the :width: and :height: options allows non-integer values to be injected into style attributes without proper escaping. This flaw can be exploited by inserting arbitrary CSS properties, creating a full-page overlay that obscures legitimate content and could be used for phishing attacks.
Users are advised to update Mistune to version 3.2.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lepture/mistune/security/advisories/GHSA-ccfx-mfmx-2fx9 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/lepture/mistune/releases/tag/v3.2.1 | [email protected] | ProductRelease Notes |
| https://github.com/lepture/mistune/security/advisories/GHSA-ccfx-mfmx-2fx9 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mistune project mistune | < 3.2.1 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |