PT-2026-39292 · Pypi · Mistune

Across-Verticals-Malaysia + 1 · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-44708

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mistune (affected versions not specified)

Description The math plugin in Mistune fails to sanitize user-supplied content when rendering inline math ($...$) and block math ($$...$$). The plugin concatenates raw input directly into the HTML output, ignoring the escape=True flag intended to ensure all user-controlled text is sanitized before reaching the DOM. This occurs within the render inline math() and render block math() functions located in src/mistune/plugins/math.py, which do not call the necessary escaping utilities or check the renderer's escape status. Consequently, an attacker can bypass security controls to execute Cross-Site Scripting (XSS) attacks, potentially allowing the exfiltration of session cookies, mutation of page content, or redirection of users.

Recommendations As a temporary workaround, consider disabling the math plugin until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-44708

GHSA-8G87-J6Q8-G93X

Affected Products

Mistune

References · 6

• 🔥 https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x · Exploit
• https://osv.dev/vulnerability/GHSA-8g87-j6q8-g93x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44708 · Security Note
• https://github.com/lepture/mistune/releases/tag/v3.2.1 · Note
• https://github.com/lepture/mistune · Note
• https://twitter.com/dailycve/status/2052955675873906819 · Twitter Post