PT-2026-56509 · Pypi · Mistune
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Mistune versions prior to 3.3.0
Description
The
HTMLRenderer.safe url() function fails to block percent-encoded javascript URIs. This allows an attacker to use specially crafted Markdown links or images to bypass URL protections and execute arbitrary scripts within the rendered HTML.Recommendations
Update to version 3.3.0.
As a temporary mitigation, restrict the use of the
HTMLRenderer.safe url() function when processing untrusted Markdown input.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mistune