CSS Injection Vulnerability in Mistune Affects Markdown Inputs

CVE-2026-115351

What is CVE-2026-115351?

Mistune versions prior to 3.3.0 are susceptible to a CSS injection vulnerability due to the unchecked figwidth option in the figure directive. This flaw enables attackers to manipulate markdown inputs, leading to potential injection of arbitrary CSS styles. By exploiting this vulnerability, attackers can craft malicious markdown that, when rendered, allows them to insert background URLs into the figure's style attribute. This exploitation can compromise user privacy by causing victim browsers to make unsolicited requests to attacker-controlled servers, potentially leaking sensitive information.

References