AZL-88400
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-88400.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-88400
- Upstream
- Published
- 2026-05-26T21:16:39Z
- Modified
- 2026-08-28T17:47:37.643913466Z
- Summary
- CVE-2026-44897 affecting package python-mistune for versions less than 3.2.1-1
- Details
-
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string-concatenating the id attribute value directly into the HTML — with no call to escape(), safe_entity(), or any other sanitisation function. A double-quote character " in the id value terminates the attribute, allowing an attacker to inject arbitrary additional attributes (event handlers, src=, href=, etc.) into the heading element. This vulnerability is fixed in 3.2.1.
- References