MEDIUM 5.3 NVD
CVE-2026-115351
Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations v
Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.
References
- https://github.com/lepture/mistune/security/advisories/GHSA-xmwc-wjpr-q378
- https://www.vulncheck.com/advisories/mistune-3.2.1-before-3.3.0-css-injection-via-figure-d
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-22 via NVD.
vulnfeed aggregates 17279 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.