Mistune Project Mistune any version

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.

Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Mistune: XSS via unescaped class option in Admonition directive

Mistune Math Plugin XSS Escape Bypass

Mistune: XSS via unescaped figclass/figwidth in Figure directive

Mistune Heading ID Attribute Injection XSS

Mistune TOC Anchor Injection XSS

Mistune Image Directive CSS Injection Vulnerability

Mistune: Arbitrary File Read via Include directive path traversal

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content