Mistune Project Mistune

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.

mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions.

Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Mistune: XSS via unescaped class option in Admonition directive

Mistune Image Directive CSS Injection Vulnerability

Mistune TOC Anchor Injection XSS

Mistune Heading ID Attribute Injection XSS

Mistune: XSS via unescaped figclass/figwidth in Figure directive

Mistune Math Plugin XSS Escape Bypass

Mistune: Arbitrary File Read via Include directive path traversal

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content