GHSA-58cw-g322-p94v

Source

https://github.com/advisories/GHSA-58cw-g322-p94v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-58cw-g322-p94v/GHSA-58cw-g322-p94v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-58cw-g322-p94v

Aliases

CVE-2026-44896

Published

2026-05-08T23:43:12Z

Modified

2026-05-09T00:02:46.273803Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Mistune has XSS via unescaped figclass/figwidth in Figure directive

Details

In src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options directly into HTML attributes without escaping (lines 152-168).

This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used, because these values bypass the inline renderer.

Other attributes in the same file (src, alt, style) are properly escaped; figclass/figwidth were missed.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T23:43:12Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "nvd_published_at": null
}

References

Affected packages

PyPI / mistune

Package

Name: mistune; View open source insights on deps.dev
Purl: pkg:pypi/mistune

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

3.2.0

Affected versions

0.*

0.1.0

0.2.0

0.3.0

0.3.1

0.4

0.4.1

0.5

0.5.1

0.6

0.7

0.7.1

0.7.2

0.7.3

0.7.4

0.8

0.8.1

0.8.2

0.8.3

0.8.4

2.*

2.0.0a1

2.0.0a2

2.0.0a3

2.0.0a4

2.0.0a5

2.0.0a6

2.0.0rc1

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

3.*

3.0.0a1

3.0.0a2

3.0.0a3

3.0.0rc1

3.0.0rc2

3.0.0rc3

3.0.0rc4

3.0.0rc5

3.0.0

3.0.1

3.0.2

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-58cw-g322-p94v/GHSA-58cw-g322-p94v.json"