CVE-2026-44896 Overview
CVE-2026-44896 is a Cross-Site Scripting (XSS) vulnerability in Mistune, a Python Markdown parser library with renderers and plugins. The flaw exists in the render_figure() function within src/mistune/directives/image.py. This function concatenates the figclass and figwidth directive options directly into HTML attributes without escaping. The vulnerability affects Mistune versions 3.2.0 and earlier. Because the values bypass the inline renderer, attribute injection and XSS occur even when applications use HTMLRenderer(escape=True), which developers typically rely on as a safe default.
Critical Impact
Attackers can inject arbitrary HTML attributes and JavaScript payloads through figure directives, executing scripts in the browsers of users viewing rendered Markdown content.
Affected Products
- Mistune Python Markdown parser, versions 3.2.0 and earlier
- Applications using HTMLRenderer with figure directive support
- Web applications and documentation systems that render untrusted Markdown via Mistune
Discovery Timeline
- 2026-05-26 - CVE-2026-44896 published to the National Vulnerability Database
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-44896
Vulnerability Analysis
The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting). The attack vector is network-based and requires user interaction, since a victim must view rendered Markdown content. Mistune's figure directive accepts figclass and figwidth options that control the rendered HTML output. The render_figure() function in src/mistune/directives/image.py interpolates these option values directly into the resulting HTML element without applying HTML attribute escaping. As a result, an attacker who controls Markdown input can break out of the intended attribute context and inject additional attributes such as onerror, onload, or onclick handlers carrying JavaScript payloads.
Root Cause
The root cause is missing output encoding on directive option values. Mistune's general HTMLRenderer(escape=True) configuration sanitizes inline content through the inline renderer pipeline. However, directive option values for figures are passed directly to render_figure() and concatenated into the output string. This code path bypasses the inline renderer, so the standard escape logic never executes against figclass and figwidth values.
Attack Vector
An attacker submits Markdown content containing a figure directive with malicious figclass or figwidth values. The attacker terminates the intended attribute with a quote character, then adds an event handler attribute pointing to JavaScript. When Mistune renders the document, the resulting HTML contains the injected attribute. Any user who loads the rendered page in a browser triggers the script in the context of the hosting application, enabling session theft, account takeover, or further client-side attacks.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-58cw-g322-p94v for technical details from the maintainers.
Detection Methods for CVE-2026-44896
Indicators of Compromise
- Markdown documents containing figure directives with suspicious figclass or figwidth values that include quote characters, angle brackets, or on* event handler keywords
- Rendered HTML pages containing unexpected event handler attributes such as onerror, onload, or onclick on <figure> or <img> elements
- Web server logs showing inbound requests that submit Markdown content with directive options containing JavaScript URI schemes or HTML control characters
Detection Strategies
- Inventory all Python applications and dependencies to identify installations of mistune at version 3.2.0 or earlier using pip list or software composition analysis tooling
- Review application source code for use of Mistune's figure directive and any path that renders user-supplied Markdown
- Deploy content security policy (CSP) violation reporting to identify inline script execution attempts originating from rendered Markdown pages
Monitoring Recommendations
- Monitor outbound requests from browser sessions that load Markdown-rendered pages for unexpected destinations indicating data exfiltration
- Log and alert on Markdown submissions containing directive syntax combined with HTML control characters
- Track Mistune version changes across development, staging, and production environments to confirm patched releases reach all systems
How to Mitigate CVE-2026-44896
Immediate Actions Required
- Upgrade Mistune to a fixed version above 3.2.0 once released by the maintainers; consult the GitHub Security Advisory for the patched version number
- Disable the figure directive in Mistune configurations if the application does not require it
- Apply server-side input validation to reject Markdown containing figure directives with quote characters or HTML control characters in option values
Patch Information
The Mistune maintainers published a security advisory at GHSA-58cw-g322-p94v. Administrators should follow that advisory for the official fixed version and upgrade guidance. After upgrading, restart all Python services that import Mistune to ensure the patched library loads into memory.
Workarounds
- Strip or sanitize figure directives from user-supplied Markdown before passing input to Mistune using a pre-processing filter
- Apply a strict Content Security Policy that disallows inline event handlers and unsafe-inline script sources, reducing the impact of injected attributes
- Post-process Mistune's HTML output with a dedicated HTML sanitizer such as bleach configured with a strict allowlist of attributes
# Example: identify affected Mistune installations across Python environments
pip show mistune | grep -i version
pip install --upgrade mistune
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
