https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:35:29 +0000 https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2026-59926 <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>In `src/mistune/directives/admonition.py`, the `render_admonition()` function concatenates the `:class:` option directly into the HTML class attribute without escaping (lines 63-68).</p> <p>This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used.</p> <p>The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.</p> <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>In `src/mistune/directives/admonition.py`, the `render_admonition()` function concatenates the `:class:` option directly into the HTML class attribute without escaping (lines 63-68).</p> <p>This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used.</p> <p>The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.</p> https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2026-59926 https://cve.radiocsirt.org/vuln/euvd-2026-334046 EUVD-2026-334046 https://cve.radiocsirt.org/vuln/euvd-2026-334046 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59926 <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59926 https://cve.radiocsirt.org/vuln/ghsa-g97x-gvcm-x72h <p><strong>Affected:</strong> PyPI: mistune</p> <p>In `src/mistune/directives/admonition.py`, the `render_admonition()` function concatenates the `:class:` option directly into the HTML class attribute without escaping (lines 63-68).</p> <p>This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used.</p> <p>The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.</p> <p><strong>Affected:</strong> PyPI: mistune</p> <p>In `src/mistune/directives/admonition.py`, the `render_admonition()` function concatenates the `:class:` option directly into the HTML class attribute without escaping (lines 63-68).</p> <p>This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used.</p> <p>The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.</p> https://cve.radiocsirt.org/vuln/ghsa-g97x-gvcm-x72h https://cve.radiocsirt.org/vuln/msrc_cve-2026-59926 msrc_CVE-2026-59926 https://cve.radiocsirt.org/vuln/msrc_cve-2026-59926 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21339-1 <p>Security update for python-mistune</p> <p>Security update for python-mistune</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21339-1 https://cve.radiocsirt.org/vuln/pysec-2026-2214 <p><strong>Affected:</strong> PyPI: mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.</p> <p><strong>Affected:</strong> PyPI: mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2214 https://cve.radiocsirt.org/vuln/suse-su-2026:22655-1 <p>Security update for python-mistune</p> <p>Security update for python-mistune</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22655-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59926 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mistune, Ubuntu:18.04:LTS: mistune, Ubuntu:20.04:LTS: mistune, Ubuntu:22.04:LTS: mistune, Ubuntu:24.04:LTS: mistune, Ubuntu:25.10: mistune, Ubuntu:26.04:LTS: mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mistune, Ubuntu:18.04:LTS: mistune, Ubuntu:20.04:LTS: mistune, Ubuntu:22.04:LTS: mistune, Ubuntu:24.04:LTS: mistune, Ubuntu:25.10: mistune, Ubuntu:26.04:LTS: mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59926