CVE-2026-44896
Modified Modified - Updated After Analysis
Mistune Markdown Parser Attribute Injection and XSS Vulnerability

Publication date: 2026-05-26

Last updated on: 2026-06-09

Assigner: GitHub, Inc.

Description
Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used, because these values bypass the inline renderer. Version 3.2.1 contains a patch.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-26
Last Modified
2026-06-09
Generated
2026-06-16
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-14
NVD
CVE-2026-44896
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mistune_project mistune to 3.2.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Mistune, a Python Markdown parser. In versions 3.2.0 and earlier, the render_figure() function in the image.py file concatenates the figclass and figwidth options directly into HTML attributes without escaping them. This improper handling allows an attacker to inject malicious attributes, leading to Cross-Site Scripting (XSS) attacks, even when the HTMLRenderer is set to escape HTML content.

Impact Analysis

The vulnerability can lead to attribute injection and Cross-Site Scripting (XSS) attacks. This means that an attacker could inject malicious scripts into web pages rendered by Mistune, potentially compromising the security of users by executing unauthorized scripts in their browsers. This can result in data theft, session hijacking, or other malicious activities.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44896. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart