https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 12:08:43 +0000 https://db.gcve.eu/vuln/cve-2026-59926 <p><strong>Affected:</strong> lepture mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.</p> <p><strong>Affected:</strong> lepture mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.</p> https://db.gcve.eu/vuln/cve-2026-59926 https://db.gcve.eu/vuln/ghsa-g97x-gvcm-x72h <p><strong>Affected:</strong> PyPI: mistune</p> <p>In `src/mistune/directives/admonition.py`, the `render_admonition()` function concatenates the `:class:` option directly into the HTML class attribute without escaping (lines 63-68).</p> <p>This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used.</p> <p>The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.</p> <p><strong>Affected:</strong> PyPI: mistune</p> <p>In `src/mistune/directives/admonition.py`, the `render_admonition()` function concatenates the `:class:` option directly into the HTML class attribute without escaping (lines 63-68).</p> <p>This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used.</p> <p>The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.</p> https://db.gcve.eu/vuln/ghsa-g97x-gvcm-x72h https://db.gcve.eu/vuln/pysec-2026-2214 <p><strong>Affected:</strong> PyPI: mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.</p> <p><strong>Affected:</strong> PyPI: mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.</p> https://db.gcve.eu/vuln/pysec-2026-2214