CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products & vendors

Mistune — security advisories

5 advisorieslatest 2026-07-02⚡ RSS feed

Tracked Mistune products:

⚡ Watch Mistune

Get an email when a new Mistune advisory drops — max one per day, one-click unsubscribe.

CVE-2026-59926: Mistune: XSS via unescaped class option in Admonition directive

mediumCVSS 6.1CVE-2026-59926msrc2026-07-02

CVE-2026-59930: Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

mediumCVSS 4.3CVE-2026-59930msrc2026-07-02

CVE-2026-59928: Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

highCVSS 7.5CVE-2026-59928msrc2026-07-02

CVE-2026-59925: inline_parser: quadratic-time parsing on long runs of `x` and `x` emphasis pairs

highCVSS 7.5CVE-2026-59925msrc2026-07-02

CVE-2026-49851: Mistune: Potential DoS via quadratic-time parsing in parse_link_text

unknownCVE-2026-49851msrc2026-06-09