Vulnerability in Mistune Python Markdown Parser Affects Image Directive Plugin

CVE-2026-44899

What is CVE-2026-44899?

The Mistune Python Markdown parser contains a vulnerability in the Image directive plugin prior to version 3.2.1. This issue arises from improper validation of the :width: and :height: options, allowing non-integer values to be processed. Consequently, the input may be directly inserted into style attributes without proper escaping, leading to potential CSS injection attacks. Users are encouraged to update to version 3.2.1 or later to mitigate this risk. For further information, please refer to the security advisory and release notes provided by the vendor.

References