Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version 3.3.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/lepture/mistune/commit/c7101fcbb6e8790e8e39157c5ca2238fc6dd6cbc Patch
- https://github.com/lepture/mistune/security/advisories/GHSA-8c25-4j27-2rv3 Exploit, Vendor Advisory
- https://github.com/lepture/mistune/security/advisories/GHSA-8c25-4j27-2rv3 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.1 · mistune_projectNVD modified 2026-10-25 17:10
Affected (CPE criteria) 1
cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*
References 4
- https://github.com/lepture/mistune/commit/c7101fcbb6e8790e8e39157c5ca2238fc6dd6cbc Patch
- https://github.com/lepture/mistune/releases/tag/v3.3.0 Release Notes
- https://github.com/lepture/mistune/security/advisories/GHSA-8c25-4j27-2rv3 Exploit, Vendor Advisory
- https://github.com/lepture/mistune/security/advisories/GHSA-8c25-4j27-2rv3 Exploit, Vendor Advisory