{"id":"CVE-2026-115351","kind":"vulnerability","aliases":["CVE-2026-115351"],"related":[],"title":"Mistune: unvalidated figure directive option lets markdown inject CSS","description":"Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.","summary":"Mistune, a Python Markdown parser, does not validate the figwidth option of its figure directive, so attacker-controlled markdown can add arbitrary CSS declarations to rendered output. An attacker can use this to make victim browsers request URLs on attacker servers and leak attribute values.","severity":"medium","cvss":5.3,"epss":0.00221,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mistune","package","python","user-generated-content"],"not_affected_if":["no-figure-directive","trusted-markdown-only"],"how_to_check":"- Run `pip show mistune` and check whether the version is at least `3.2.1` and below `3.3.0`\n- Search the codebase for `figure` directives or `figwidth` usage in rendered markdown","fix":"- Upgrade mistune to `3.3.0` or later","status":"open","published_at":"2026-10-22T19:17:40+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:19:03+00:00","updated_at":"2026-10-25T04:19:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:19:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade mistune to `3.3.0` or later","reach":"internet","title":"Mistune: unvalidated figure directive option lets markdown inject CSS","impact":"low","summary":"Mistune, a Python Markdown parser, does not validate the figwidth option of its figure directive, so attacker-controlled markdown can add arbitrary CSS declarations to rendered output. An attacker can use this to make victim browsers request URLs on attacker servers and leak attribute values.","category":"package","nicknames":[],"who_cares":["python","mistune","user-generated-content"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker leaks attribute values from victim browsers via CSS-triggered requests","analyst_note":"","how_to_check":"- Run `pip show mistune` and check whether the version is at least `3.2.1` and below `3.3.0`\n- Search the codebase for `figure` directives or `figwidth` usage in rendered markdown","needs_analyst":false,"not_affected_if":["trusted-markdown-only","no-figure-directive"],"who_is_affected":"Applications that render untrusted or user-supplied markdown with mistune 3.2.1 through 3.2.x and use the figure directive, since the injected style lands in the rendered HTML. Sites that only render trusted markdown, or that do not use the figure directive, are unlikely to be exposed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000598,"input_tokens":3395,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115351':12A,15A '-2026':11A,14A '3.2.1':71C '3.3.0':73C 'add':44B 'allow':80C 'append':101C 'arbitrari':45B,87C 'attack':40B,52B,63B,81C,99C,119C 'attacker-control':39B 'attribut':67B,111C,123C 'background':104C 'browser':59B,114C 'contain':74C 'content':22B 'control':41B,82C 'css':9A,46B,76C 'cve':10A,13A 'declar':47B,89C,102C 'direct':4A,37B,98C 'figur':3A,36B,97C,109C 'figwidth':32B,93C 'forc':112C 'generat':21B 'inject':8A,77C,86C 'input':84C 'leak':66B,122C 'let':6A 'like':103C 'make':57B 'markdown':7A,26B,42B,83C 'mistun':1A,16B,23B,69C 'option':5A,33B,94C 'output':50B 'packag':17B 'parser':27B 'python':18B,25B 'render':49B,108C 'request':60B,117C 'send':116C 'server':64B,120C 'style':88C,110C 'unvalid':2A,92C 'url':61B,105C 'use':54B 'user':20B 'user-generated-cont':19B 'valid':30B 'valu':68B,124C 'via':90C 'victim':58B,113C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Applications that render untrusted or user-supplied markdown with mistune 3.2.1 through 3.2.x and use the figure directive, since the injected style lands in the rendered HTML. Sites that only render trusted markdown, or that do not use the figure directive, are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115351","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115351","severity":null,"published_at":"2026-10-22T19:17:40+00:00","modified_at":"2026-10-22T19:17:41+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115351","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115351","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}