If you discover a security vulnerability, do not submit a public issue or patch. Instead, please report it privately through the GitHub Security tab.
Repository navigation
Security: lepture/mistune
Security
.github/SECURITY.md
-
Quadratic-time DoS in _process_emphasis_delimiters index-fixup loopGHSA-qp42-r9j6-83g9 published
Oct 19, 2026 by leptureHigh -
Quadratic-time DoS in inline image parsing (precedence_scan) bypasses not-is-image guardsGHSA-ww7q-mxrj-5ffg published
Oct 19, 2026 by leptureHigh -
Quadratic-time DoS in parse_link_href via unbounded parenthesis scan on empty-label linksGHSA-phmp-hrw4-r36r published
Oct 19, 2026 by leptureHigh -
Denial of Service — RecursionError via Excessive Emphasis Markers in MarkdownGHSA-6m44-fpc8-c3rq published
Aug 21, 2026 by leptureHigh -
Balanced-bracket variant of the bracket parsing DoS still causes quadratic CPU growth in Mistune 3.3.2GHSA-47p6-w2rc-5qf7 published
Oct 19, 2026 by leptureModerate -
Percent-encoded URL scheme bypass allows XSS via javascript: protocol in safe_url()GHSA-8ppg-4vv7-9p53 published
Jun 21, 2026 by leptureModerate -
XSS via percent-encoded protocol bypass in safe_url() — javascript%3A bypasses javascript: filterGHSA-jxhr-4j38-fpxg published
Jun 21, 2026 by leptureHigh -
Quadratic DoS in parse_link_text via unmatched bracket runsGHSA-f32h-38gf-rg5r published
Jun 21, 2026 by leptureModerate -
mistune: quadratic-time DoS in inline link parser on unbalanced [GHSA-x2gr-6qf2-fc9x published
Jun 21, 2026 by leptureHigh -
Potential DoS via quadratic-time parsing in parse_link_textGHSA-qcq2-496w-v96p published
Jun 21, 2026 by leptureHigh
Learn more about advisories related to lepture/mistune in the GitHub Advisory Database