CVE-2026-115349High· 7.5▾ TwilightMistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering qua…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
mistune >= 3.0.0 < 3.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49851High· 7.5Mistune: Potential DoS via quadratic-time parsing in parse_link_text
CVE-2026-33079High· 7.5In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker who can supply Markdown for parsing to cause denial of service
CVE-2026-115355High· 7.5Mistune before 3.3.0 Path Traversal and XSS via Include Directive
CVE-2026-115353High· 8.6Mistune before 3.3.0 Path Traversal via include Directive
CVE-2026-115351Medium· 4.7Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option
CVE-2026-115352High· 7.5Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser