CVE-2026-115351 — Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidate…

Published: 2026-10-22 · CVSS: 5.3 · CVSS 4.0

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.

Original CVE JSON · STIX 2.1

Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7