CVE-2026-115352High· 7.5▾ TwilightMistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown p…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.
mistune < 3.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115347High· 7.5Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
CVE-2026-115355High· 7.5Mistune before 3.3.0 Path Traversal and XSS via Include Directive
CVE-2026-115353High· 8.6Mistune before 3.3.0 Path Traversal via include Directive
CVE-2026-115351Medium· 4.7Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option
CVE-2026-115354Medium· 6.5Mistune before 3.3.0 Arbitrary Local File Read via Include Directive
CVE-2026-115348High· 7.5Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text