Sergeykochanov

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.2.1 **Description** The `render admonition()` function in `src/mistune/directives/admonition.py` concatenates the `:class:` option of the Admonition directive into the HTML class attribute without proper escaping. This allows for attribute injection and cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, even when the HTMLRenderer escape mode is active. **Recommendations** Update to version 3.2.1.

**Name of the Vulnerable Software and Affected Versions** Mistune (affected versions not specified) **Description** The `render figure()` function in `src/mistune/directives/image.py` concatenates `figclass` and `figwidth` options directly into HTML attributes without escaping. This allows attribute injection and Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites, even when `HTMLRenderer(escape=True)` is enabled, as these specific values bypass the inline renderer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.