Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used, because these values bypass the inline renderer. Version 3.2.1 contains a patch.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 Mistune, XSS, #CVE-2026-44896 (Medium) https://dailycve.com/mistune-xss-cve-2026-44896-medium/
Post summary
A new XSS vulnerability (CVE-2026-44896) in Mistune has been disclosed with medium severity, but no PoC, exploit details, or exploitation information are supplied.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mistune_project | mistune | - | - | - |