high8.7
mistune
Follow this packageGet the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.
Check the version you ship.
Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.
Advisories & recorded fixes
high7.1
CVE-2026-115354
Mistune before 3.3.0 Arbitrary Local File Read via Include Directive
lepture · mistune
medium5.3
CVE-2026-115351
Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option
lepture · mistune
medium6.1
high8.7
CVE-2026-115349
Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
lepture · mistune
high8.7
CVE-2026-115347
Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
lepture · mistune