{"id":"CVE-2026-44896","title":"Mistune: XSS via unescaped figclass/figwidth in Figure directive","published":"2026-05-26T17:16:39.477Z","updated":"2026-07-24T07:10:00.170Z","severity":"medium","cvssScore":5.3,"epss":0.00198,"epssPct":0.09729,"kev":false,"maturity":"none","actionScore":21,"primaryVendor":"mistune project","primaryProduct":"mistune","cweId":"CWE-79","fixAvailable":true,"tags":["pre-auth","xss","remote"],"epssDelta7":0,"summary":"Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used, because these values bypass the inline renderer. Version 3.2.1 contains a patch.","cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvssVersion":"4.0","cvssSource":"nvd-secondary","cweName":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"GitHub_M","ssvc":{"exploitation":"none","automatable":"yes","impact":"partial"},"sources":{"adp":"2026-06-08T23:34:02.448Z","cna":"2026-06-08T23:34:02.448Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","msrc":"2026-10-19T03:24:56.633Z","cna_seen":"2026-09-29T11:21:50.240Z"},"cvssCna":{"score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0"},"hasPatchRef":true,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"mistune project","product":"mistune","cpe":"cpe:2.3:a:mistune_project:mistune"}],"references":[{"url":"https://github.com/lepture/mistune/commit/a3cb6e5655308797e8be021d6c7b5bab13cbace2","tags":null},{"url":"https://github.com/lepture/mistune/security/advisories/GHSA-58cw-g322-p94v","tags":"Vendor Advisory"}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"mistune project","product":"mistune","version":"*","vsi":null,"vse":null,"vei":"3.2.0","vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}