# Lepture vulnerabilities Source: https://junglewise.ai/threats/vendors/lepture Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/lepture.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 27 vulnerabilities in Lepture: 0 in the last 7 days and 11 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, Mistune path traversal and XSS in Include directive, was published on 22 October 2026. 10 vulnerabilities in the last four weeks, up from none in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 10 - Last 90 days: 11 - All time: 27 (0 critical, 0 exploited in the wild) ## About Lepture Software developer who maintains open source projects including the mistune Markdown parser. ## Latest Lepture vulnerabilities - [Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115355: Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115354: Mistune path traversal in Include directive](https://junglewise.ai/threats/cve-2026-115354-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (medium, CVSS 6.5, published 22 Oct 2026) - [CVE-2026-115353: Mistune path traversal in RST include directive](https://junglewise.ai/threats/cve-2026-115353-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (high, CVSS 8.6, published 22 Oct 2026) - [CVE-2026-115352: Mistune algorithmic complexity DoS in inline link parser](https://junglewise.ai/threats/cve-2026-115352-mistune-before-3-3-0-contains-an-algorithmic-complexity) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115351: Mistune CSS injection in figure directive](https://junglewise.ai/threats/cve-2026-115351-mistune-from-3-2-1-before-3-3-0-contains-a-css-injection) (medium, CVSS 4.7, published 22 Oct 2026) - [CVE-2026-115350: Mistune cross-site scripting in Include directive for HTML files](https://junglewise.ai/threats/cve-2026-115350-mistune-before-3-3-0-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 22 Oct 2026) - [CVE-2026-115349: Mistune ReDoS in parse_link_text function](https://junglewise.ai/threats/cve-2026-115349-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115348: Mistune algorithmic complexity DoS in inline link parser](https://junglewise.ai/threats/cve-2026-115348-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115347: Mistune parse_link_text quadratic denial of service](https://junglewise.ai/threats/cve-2026-115347-mistune-before-3-3-0-contains-an-inefficient-algorithmic) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-76098: Mistune uncontrolled recursion in HTML rendering](https://junglewise.ai/threats/cve-2026-76098-mistune-uncontrolled-recursion-in-html-rendering) (high, CVSS 7.5, published 24 Aug 2026) - [CVE-2026-59930: lepture Mistune predictable ID generation in TOC plugin](https://junglewise.ai/threats/cve-2026-59930-lepture-mistune-predictable-id-generation-in-toc-plugin) (medium, CVSS 4.3, published 8 Jul 2026) - [CVE-2026-59929: lepture mistune XSS via incomplete URL scheme filtering in HTML renderer](https://junglewise.ai/threats/cve-2026-59929-lepture-mistune-xss-via-incomplete-url-scheme-filtering-in-html) (medium, CVSS 6.1, published 8 Jul 2026) - [CVE-2026-59928: lepture Mistune denial of service in reference-link parsing](https://junglewise.ai/threats/cve-2026-59928-lepture-mistune-denial-of-service-in-reference-link-parsing) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-59927: lepture Mistune uncontrolled recursion in Include directive](https://junglewise.ai/threats/cve-2026-59927-lepture-mistune-uncontrolled-recursion-in-include-directive) (medium, CVSS 5.3, published 8 Jul 2026) - [CVE-2026-59926: lepture Mistune XSS in Admonition directive](https://junglewise.ai/threats/cve-2026-59926-lepture-mistune-xss-in-admonition-directive) (medium, CVSS 4, published 8 Jul 2026) - [CVE-2026-59925: Mistune denial of service via quadratic emphasis parsing](https://junglewise.ai/threats/cve-2026-59925-mistune-denial-of-service-via-quadratic-emphasis-parsing) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-59924: lepture Mistune path traversal in Include directive](https://junglewise.ai/threats/cve-2026-59924-lepture-mistune-path-traversal-in-include-directive) (medium, CVSS 5.9, published 8 Jul 2026) - [CVE-2026-59923: lepture Mistune XSS via percent-encoded bypass in safe_url](https://junglewise.ai/threats/cve-2026-59923-lepture-mistune-xss-via-percent-encoded-bypass-in-safe-url) (medium, CVSS 6.1, published 8 Jul 2026) - [CVE-2026-59922: lepture Mistune denial of service in formatting plugins](https://junglewise.ai/threats/cve-2026-59922-lepture-mistune-denial-of-service-in-formatting-plugins) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-49851: lepture Mistune CPU exhaustion DoS in parse_link_text](https://junglewise.ai/threats/cve-2026-49851-lepture-mistune-cpu-exhaustion-dos-in-parse-link-text) (high, CVSS 7.5, published 24 Jun 2026) - [CVE-2026-44899: lepture Mistune CSS injection in Image directive plugin](https://junglewise.ai/threats/cve-2026-44899-lepture-mistune-css-injection-in-image-directive-plugin) (medium, CVSS 4.7, published 26 May 2026) - [CVE-2026-44898: lepture Mistune XSS in Table of Contents generation](https://junglewise.ai/threats/cve-2026-44898-lepture-mistune-xss-in-table-of-contents-generation) (medium, CVSS 6.1, published 26 May 2026) - [CVE-2026-44897: Mistune XSS via unsanitized heading ID attribute](https://junglewise.ai/threats/cve-2026-44897-mistune-xss-via-unsanitized-heading-id-attribute) (medium, CVSS 6.1, published 26 May 2026) - [CVE-2026-44896: lepture Mistune XSS in Figure directive image attributes](https://junglewise.ai/threats/cve-2026-44896-lepture-mistune-xss-in-figure-directive-image-attributes) (medium, CVSS 6.1, published 26 May 2026) ## Most severe Lepture vulnerabilities - [CVE-2026-115353: Mistune path traversal in RST include directive](https://junglewise.ai/threats/cve-2026-115353-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (high, CVSS 8.6, published 22 Oct 2026) - [CVE-2026-33079: Mistune ReDoS in LINK_TITLE_RE](https://junglewise.ai/threats/cve-2026-33079-mistune-redos-in-link-title-re) (high, CVSS 7.5, published 6 May 2026) - [CVE-2026-59928: lepture Mistune denial of service in reference-link parsing](https://junglewise.ai/threats/cve-2026-59928-lepture-mistune-denial-of-service-in-reference-link-parsing) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-59925: Mistune denial of service via quadratic emphasis parsing](https://junglewise.ai/threats/cve-2026-59925-mistune-denial-of-service-via-quadratic-emphasis-parsing) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-59922: lepture Mistune denial of service in formatting plugins](https://junglewise.ai/threats/cve-2026-59922-lepture-mistune-denial-of-service-in-formatting-plugins) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-49851: lepture Mistune CPU exhaustion DoS in parse_link_text](https://junglewise.ai/threats/cve-2026-49851-lepture-mistune-cpu-exhaustion-dos-in-parse-link-text) (high, CVSS 7.5, published 24 Jun 2026) - [CVE-2026-76098: Mistune uncontrolled recursion in HTML rendering](https://junglewise.ai/threats/cve-2026-76098-mistune-uncontrolled-recursion-in-html-rendering) (high, CVSS 7.5, published 24 Aug 2026) - [CVE-2026-115355: Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (high, CVSS 7.5, published 22 Oct 2026) - [Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115352: Mistune algorithmic complexity DoS in inline link parser](https://junglewise.ai/threats/cve-2026-115352-mistune-before-3-3-0-contains-an-algorithmic-complexity) (high, CVSS 7.5, published 22 Oct 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 10 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Lepture technologies - [Lepture Mistune](https://junglewise.ai/threats/technologies/lepture-mistune): 10 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Lepture vulnerabilities", https://junglewise.ai/threats/vendors/lepture, 9 November 2026.