mistune vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-59929Mediummistune: Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` executionCVE-2026-59930Mediummistune: Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with…CVE-2026-59924Mediummistune: Mistune: Arbitrary File Read via Include directive path traversalCVE-2026-59922Highmistune: Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)CVE-2026-59926Mediummistune: Mistune: XSS via unescaped class option in Admonition directiveCVE-2026-59923Mediummistune: Mistune: XSS via percent-encoded javascript URI bypass in safe_url()CVE-2026-59925Highmistune: Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsCVE-2026-59927Mediummistune: Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two…CVE-2026-59928Highmistune: Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsCVE-2026-49851Highmistune: Mistune: Potential DoS via quadratic-time parsing in parse_link_textCVE-2026-44899Mediummistune: Mistune Image Directive CSS Injection VulnerabilityCVE-2026-44898Mediummistune: Mistune TOC Anchor Injection XSSCVE-2026-44897Mediummistune: Mistune Heading ID Attribute has Injection XSSCVE-2026-44896Mediummistune: Mistune has XSS via unescaped figclass/figwidth in Figure directiveCVE-2026-44708Mediummistune: Mistune Math Plugin has an XSS Escape BypassCVE-2026-33079Highmistune: Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown inputCVE-2022-34749Highmistune: Mistune vulnerable to catastrophic backtrackingCVE-2017-15612Mediummistune: Cross-site Scripting in MistuneCVE-2017-16876Mediummistune: mistune Cross-site scripting (XSS) vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo