# mistune (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/mistune Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/mistune.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 23 vulnerabilities in mistune (PyPI): 0 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, Mistune path traversal and XSS in Include directive, was published on 22 October 2026. 2 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 3 - All time: 23 (0 critical, 0 exploited in the wild) ## About mistune (PyPI) Python library for parsing and rendering Markdown markup language. ## Latest mistune (PyPI) vulnerabilities - [Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115355: Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-76098: Mistune uncontrolled recursion in HTML rendering](https://junglewise.ai/threats/cve-2026-76098-mistune-uncontrolled-recursion-in-html-rendering) (high, CVSS 7.5, published 24 Aug 2026) - [CVE-2026-59930: lepture Mistune predictable ID generation in TOC plugin](https://junglewise.ai/threats/cve-2026-59930-lepture-mistune-predictable-id-generation-in-toc-plugin) (medium, CVSS 4.3, published 8 Jul 2026) - [CVE-2026-59929: lepture mistune XSS via incomplete URL scheme filtering in HTML renderer](https://junglewise.ai/threats/cve-2026-59929-lepture-mistune-xss-via-incomplete-url-scheme-filtering-in-html) (medium, CVSS 6.1, published 8 Jul 2026) - [CVE-2026-59928: lepture Mistune denial of service in reference-link parsing](https://junglewise.ai/threats/cve-2026-59928-lepture-mistune-denial-of-service-in-reference-link-parsing) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-59927: lepture Mistune uncontrolled recursion in Include directive](https://junglewise.ai/threats/cve-2026-59927-lepture-mistune-uncontrolled-recursion-in-include-directive) (medium, CVSS 5.3, published 8 Jul 2026) - [CVE-2026-59926: lepture Mistune XSS in Admonition directive](https://junglewise.ai/threats/cve-2026-59926-lepture-mistune-xss-in-admonition-directive) (medium, CVSS 4, published 8 Jul 2026) - [CVE-2026-59925: Mistune denial of service via quadratic emphasis parsing](https://junglewise.ai/threats/cve-2026-59925-mistune-denial-of-service-via-quadratic-emphasis-parsing) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-59924: lepture Mistune path traversal in Include directive](https://junglewise.ai/threats/cve-2026-59924-lepture-mistune-path-traversal-in-include-directive) (medium, CVSS 5.9, published 8 Jul 2026) - [CVE-2026-59923: lepture Mistune XSS via percent-encoded bypass in safe_url](https://junglewise.ai/threats/cve-2026-59923-lepture-mistune-xss-via-percent-encoded-bypass-in-safe-url) (medium, CVSS 6.1, published 8 Jul 2026) - [CVE-2026-59922: lepture Mistune denial of service in formatting plugins](https://junglewise.ai/threats/cve-2026-59922-lepture-mistune-denial-of-service-in-formatting-plugins) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-49851: lepture Mistune CPU exhaustion DoS in parse_link_text](https://junglewise.ai/threats/cve-2026-49851-lepture-mistune-cpu-exhaustion-dos-in-parse-link-text) (high, CVSS 7.5, published 24 Jun 2026) - [CVE-2026-44899: lepture Mistune CSS injection in Image directive plugin](https://junglewise.ai/threats/cve-2026-44899-lepture-mistune-css-injection-in-image-directive-plugin) (medium, CVSS 4.7, published 26 May 2026) - [CVE-2026-44898: lepture Mistune XSS in Table of Contents generation](https://junglewise.ai/threats/cve-2026-44898-lepture-mistune-xss-in-table-of-contents-generation) (medium, CVSS 6.1, published 26 May 2026) - [CVE-2026-44897: Mistune XSS via unsanitized heading ID attribute](https://junglewise.ai/threats/cve-2026-44897-mistune-xss-via-unsanitized-heading-id-attribute) (medium, CVSS 6.1, published 26 May 2026) - [CVE-2026-44896: lepture Mistune XSS in Figure directive image attributes](https://junglewise.ai/threats/cve-2026-44896-lepture-mistune-xss-in-figure-directive-image-attributes) (medium, CVSS 6.1, published 26 May 2026) - [CVE-2026-44708: Mistune math plugin XSS bypass in Markdown rendering](https://junglewise.ai/threats/cve-2026-44708-mistune-math-plugin-xss-bypass-in-markdown-rendering) (medium, CVSS 6.1, published 26 May 2026) - [CVE-2026-33079: Mistune ReDoS in LINK_TITLE_RE](https://junglewise.ai/threats/cve-2026-33079-mistune-redos-in-link-title-re) (high, CVSS 7.5, published 6 May 2026) - [Duplicate Advisory: Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input](https://junglewise.ai/threats/duplicate-advisory-mistune-has-a-redos-in-link-title-re-that-allows-291d431c) (medium, CVSS 4, published 6 May 2026) - [CVE-2022-34749: Mistune vulnerable to catastrophic backtracking](https://junglewise.ai/threats/cve-2022-34749-mistune-vulnerable-to-catastrophic-backtracking) (low, CVSS 3.1, published 25 Jul 2022) - [CVE-2017-16876: mistune Cross-site scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2017-16876-mistune-cross-site-scripting-xss-vulnerability) (low, CVSS 3.1, published 29 Dec 2017) - [CVE-2017-15612: Cross-site Scripting in Mistune](https://junglewise.ai/threats/cve-2017-15612-cross-site-scripting-in-mistune) (low, CVSS 3, published 19 Oct 2017) ## Most severe mistune (PyPI) vulnerabilities - [CVE-2026-33079: Mistune ReDoS in LINK_TITLE_RE](https://junglewise.ai/threats/cve-2026-33079-mistune-redos-in-link-title-re) (high, CVSS 7.5, published 6 May 2026) - [CVE-2026-59928: lepture Mistune denial of service in reference-link parsing](https://junglewise.ai/threats/cve-2026-59928-lepture-mistune-denial-of-service-in-reference-link-parsing) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-59925: Mistune denial of service via quadratic emphasis parsing](https://junglewise.ai/threats/cve-2026-59925-mistune-denial-of-service-via-quadratic-emphasis-parsing) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-59922: lepture Mistune denial of service in formatting plugins](https://junglewise.ai/threats/cve-2026-59922-lepture-mistune-denial-of-service-in-formatting-plugins) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-49851: lepture Mistune CPU exhaustion DoS in parse_link_text](https://junglewise.ai/threats/cve-2026-49851-lepture-mistune-cpu-exhaustion-dos-in-parse-link-text) (high, CVSS 7.5, published 24 Jun 2026) - [CVE-2026-76098: Mistune uncontrolled recursion in HTML rendering](https://junglewise.ai/threats/cve-2026-76098-mistune-uncontrolled-recursion-in-html-rendering) (high, CVSS 7.5, published 24 Aug 2026) - [CVE-2026-115355: Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (high, CVSS 7.5, published 22 Oct 2026) - [Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-59923: lepture Mistune XSS via percent-encoded bypass in safe_url](https://junglewise.ai/threats/cve-2026-59923-lepture-mistune-xss-via-percent-encoded-bypass-in-safe-url) (medium, CVSS 6.1, published 8 Jul 2026) - [CVE-2026-59929: lepture mistune XSS via incomplete URL scheme filtering in HTML renderer](https://junglewise.ai/threats/cve-2026-59929-lepture-mistune-xss-via-incomplete-url-scheme-filtering-in-html) (medium, CVSS 6.1, published 8 Jul 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "mistune (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/mistune, 13 November 2026.