https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-17T09:42:48.860210+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-59926 CVE-2026-59926 — Mistune: XSS via unescaped class option in Admonition directive 2026-10-17T09:42:48.862719+00:00

Affected: lepture mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.

 https://db.gcve.eu/vuln/ghsa-g97x-gvcm-x72h GHSA-g97x-gvcm-x72h — Mistune: XSS via unescaped class option in Admonition directive 2026-10-17T09:42:48.862806+00:00

Affected: PyPI: mistune

In `src/mistune/directives/admonition.py`, the `render_admonition()` function concatenates the `:class:` option directly into the HTML class attribute without escaping (lines 63-68).

This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used.

The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.

 https://db.gcve.eu/vuln/pysec-2026-2214 PYSEC-2026-2214 2026-10-17T09:42:48.862852+00:00

Affected: PyPI: mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.