CVE-2026-44899: Mistune Image Directive CSS Injection Vulnerability

Analyzed

AliasesGHSA-ccfx-mfmx-2fx9PYSEC-2026-2209UBUNTU-CVE-2026-44899+1 more

Published 26-05-2026Last modified 27-05-2026

Vulnerability summary

CVE-2026-44899 is a medium (CVSS 6.1) vulnerability in lepture mistune. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.6% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 4.7, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.1/10

010

Medium · v3.1 (NVD)

EPSS score

0.23%

0%100%

Low · -0.04 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Timeline

26-05-2026
PublishedVulnerability first disclosed.
27-05-2026
Last modifiedVulnerability information updated.

Description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r"^\d+(?:\.\d*)?"). When the validated value is not a plain integer, render_block_image() inserts it directly into a style="width:...;" or style="height:...;" attribute. Because the value was accepted by the prefix-only regex, any CSS after the leading digits reaches the style= attribute verbatim and without escaping. This vulnerability is fixed in 3.2.1.