CVE-2026-76098High· 7.5▾ TwilightMistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, a…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
mistune >= 3.3.0, < 3.3.3Patched in:
mistune 3.3.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44896Medium· 6.1Mistune has XSS via unescaped figclass/figwidth in Figure directive
CVE-2026-44897Medium· 6.1Mistune Heading ID Attribute has Injection XSS
CVE-2026-44899Medium· 4.7Mistune Image Directive CSS Injection Vulnerability
CVE-2026-44708Medium· 6.1Mistune Math Plugin has an XSS Escape Bypass
CVE-2026-44898Medium· 6.1Mistune TOC Anchor Injection XSS
CVE-2026-49851High· 7.5Mistune: Potential DoS via quadratic-time parsing in parse_link_text