Across-Verticals-Malaysia

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.2.1 **Description** The `render toc ul()` function builds a table-of-contents tree from a list of tuples. The `id` value, used for the `href` attribute, and the `text` value, used as the link label, are inserted into `<a>` tags using a plain Python format string without HTML escaping. When heading IDs are derived from user-supplied text, an attacker can craft a heading that breaks out of the `href` attribute context to inject arbitrary HTML tags, such as `<script>` blocks, directly into the rendered table of contents. This occurs specifically within the `render toc ul()` function located in `src/mistune/toc.py`. **Recommendations** Update to version 3.2.1. As a temporary workaround, restrict the use of custom `heading id` callbacks that return raw user-supplied text as the ID.

**Name of the Vulnerable Software and Affected Versions** mistune (affected versions not specified) **Description** The Image directive plugin fails to properly validate the `:width:` and `:height:` options. The validation uses a regular expression that only checks if the value starts with a digit, rather than ensuring the entire string is a valid number. When a value is not a plain integer, it is inserted directly into a `style` attribute without escaping. This allows an attacker to inject arbitrary CSS properties by providing a value that begins with digits followed by malicious CSS. For example, using the `:width:` parameter, an attacker can inject properties such as `position:fixed`, `background-color`, and `z-index` to create a full-page phishing overlay or perform UI redressing attacks, effectively covering the entire browser viewport and concealing legitimate page content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mistune versions prior to 3.2.1 **Description** In the `HTMLRenderer.heading()` function within `src/mistune/renderers/html.py`, the `id` attribute of heading tags is constructed by directly concatenating the value into the HTML without sanitization. When the `add toc hook()` API is used with a custom `heading id` callback that returns raw heading text (a common practice for creating human-readable slug anchors), an attacker can inject a double-quote character to terminate the attribute and insert arbitrary HTML attributes, such as event handlers. This allows for the execution of malicious JavaScript when a user interacts with the heading. **Recommendations** Update to version 3.2.1 or later. As a temporary workaround, ensure that any custom callback passed to `add toc hook()` independently sanitizes or escapes the `heading id` value before returning it.

**Name of the Vulnerable Software and Affected Versions** Mistune (affected versions not specified) **Description** The math plugin in Mistune fails to sanitize user-supplied content when rendering inline math (`$...$`) and block math (`$$...$$`). The plugin concatenates raw input directly into the HTML output, ignoring the `escape=True` flag intended to ensure all user-controlled text is sanitized before reaching the DOM. This occurs within the `render inline math()` and `render block math()` functions located in `src/mistune/plugins/math.py`, which do not call the necessary escaping utilities or check the renderer's escape status. Consequently, an attacker can bypass security controls to execute Cross-Site Scripting (XSS) attacks, potentially allowing the exfiltration of session cookies, mutation of page content, or redirection of users. **Recommendations** As a temporary workaround, consider disabling the math plugin until a patch is available.

Name of the Vulnerable Software and Affected Versions Genealogy versions prior to 5.9.1 Description The Genealogy PHP application contains a broken access control issue. An authenticated user can transfer ownership of any non-personal team to themselves, leading to complete takeover of other users’ team workspaces and unrestricted access to associated genealogy data. The vulnerable function is `TeamController::transferOwnership()`, which lacks proper authorization checks. This is triggered by a single POST request. Recommendations Update to version 5.9.1 or later.