https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T15:40:06.338965+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2026-59926 BREW-adr-viewer-CVE-2026-59926 — Mistune: XSS via unescaped class option in Admonition directive 2026-10-04T15:40:06.607520+00:00

Affected: Homebrew: adr-viewer

In `src/mistune/directives/admonition.py`, the `render_admonition()` function concatenates the `:class:` option directly into the HTML class attribute without escaping (lines 63-68).

This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used.

The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.

 https://cve.radiocsirt.org/vuln/euvd-2026-334046 EUVD-2026-334046 2026-10-04T15:40:06.607582+00:00 EUVD-2026-334046 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59926 fkie_cve-2026-59926 2026-10-04T15:40:06.607599+00:00

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.

 https://cve.radiocsirt.org/vuln/ghsa-g97x-gvcm-x72h GHSA-g97x-gvcm-x72h — Mistune: XSS via unescaped class option in Admonition directive 2026-10-04T15:40:06.607623+00:00

Affected: PyPI: mistune

In `src/mistune/directives/admonition.py`, the `render_admonition()` function concatenates the `:class:` option directly into the HTML class attribute without escaping (lines 63-68).

This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used.

The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-59926 msrc_CVE-2026-59926 — Mistune: XSS via unescaped class option in Admonition directive 2026-10-04T15:40:06.607647+00:00 msrc_CVE-2026-59926 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21339-1 openSUSE-SU-2026:21339-1 — Security update for python-mistune 2026-10-04T15:40:06.607663+00:00

Security update for python-mistune

 https://cve.radiocsirt.org/vuln/pysec-2026-2214 PYSEC-2026-2214 2026-10-04T15:40:06.607685+00:00

Affected: PyPI: mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22655-1 SUSE-SU-2026:22655-1 — Security update for python-mistune 2026-10-04T15:40:06.607705+00:00

Security update for python-mistune

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59926 UBUNTU-CVE-2026-59926 2026-10-04T15:40:06.607726+00:00

Affected: Ubuntu:16.04:LTS: mistune, Ubuntu:18.04:LTS: mistune, Ubuntu:20.04:LTS: mistune, Ubuntu:22.04:LTS: mistune, Ubuntu:24.04:LTS: mistune, Ubuntu:25.10: mistune, Ubuntu:26.04:LTS: mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.