CVE-2026-44899 Mistune Image Directive CSS Injection Vulnerability
An attacker can inject malicious CSS into image directives, potentially leading to cross-site scripting attacks in applications using the Mistune library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44899?
CVE-2026-44899 is a medium-severity cross-site scripting vulnerability in lepture mistune, published on 26 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r"^\d+(?:\.\d*)?"). When the validated value is not a plain integer, render_block_image() inserts it directly into a style="width:...;" or style="height:...;" attribute. Because the value was accepted by the prefix-only regex, any CSS after the leading digits reaches the style= attribute verbatim and without escaping. This vulnerability is fixed in 3.2.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-44899?
3 open source packages ship an affected version, including mistune. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mistune PyPI | All versions | 3.2.1 |
mistune PyPI | From 3.2.0 | 3.2.1 |
mistune PyPI | From 3.2.0 | 3.2.1 |
Products include Mistune Project Mistune.
How do I fix CVE-2026-44899?
Upgrade mistune to 3.2.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-44899 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44899 exists.
Other vulnerabilities in lepture mistune
- CVE-2026-59922 Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
- CVE-2026-59925 inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
- CVE-2026-59928 Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
- CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
- CVE-2026-59929 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Sources
Also known as AZL-88406, CLEANSTART-2026-OL63472, CLEANSTART-2026-SI19530, DEBIAN-CVE-2026-44899, GHSA-ccfx-mfmx-2fx9, PYSEC-2026-2209 and 1 more.