CVE-2026-44899: Mistune Python Markdown Parser XSS Flaw

CVE-2026-44899 Overview

CVE-2026-44899 is a Cross-Site Scripting (XSS) vulnerability in Mistune, a Python Markdown parser with renderers and plugins. The flaw exists in the Image directive plugin in versions prior to 3.2.1. The plugin validates the :width: and :height: options using a prefix-only regex that accepts trailing content after a leading numeric value. The render_block_image() function then inserts the unsanitized value directly into a style="width:...;" or style="height:...;" HTML attribute. This allows attackers to inject arbitrary CSS into rendered output [CWE-79]. The vulnerability is fixed in Mistune 3.2.1.

Critical Impact
Attackers can inject arbitrary CSS into rendered HTML through Markdown image directive options, enabling content spoofing, UI manipulation, and potential exfiltration of sensitive page data via CSS-based attacks.

Affected Products

Mistune (mistune_project) versions prior to 3.2.1
Python applications using the Mistune Image directive plugin
Web applications rendering untrusted Markdown via Mistune

Discovery Timeline

2026-05-26 - CVE-2026-44899 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-44899

Vulnerability Analysis

The vulnerability resides in the Image directive plugin shipped with Mistune. The plugin parses directive options including :width: and :height:, which are intended to constrain image dimensions in the rendered HTML. The validation logic relies on a regular expression compiled as _num_re = re.compile(r"^\d+(?:\.\d*)?"). This pattern matches a leading digit sequence with an optional decimal portion but does not anchor the end of the string. Any text appearing after the numeric prefix is preserved unchanged.

When render_block_image() consumes the validated value, it embeds the string directly into an inline style attribute without HTML or CSS escaping. An attacker submitting Markdown with a crafted width or height value can inject arbitrary CSS declarations into the output. User interaction is required because the payload only triggers when a victim views the rendered page.

Root Cause

The root cause is improper input validation combined with missing output encoding. The prefix-only regex ^\d+(?:\.\d*)? lacks an end-of-string anchor ($), so values such as 100;malicious-css-here pass validation. The downstream renderer treats the value as trusted and concatenates it into an HTML attribute, producing a stored or reflected XSS-class CSS injection sink.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker submits Markdown content containing an Image directive with a :width: or :height: option whose value begins with digits but appends additional CSS. When the application renders this Markdown using Mistune and a victim loads the resulting page, the injected CSS executes in the victim's browser context. Because the scope changes from the parser to the rendering page, the impact crosses a security boundary.

The vulnerability manifests in the Image directive plugin's option validation path. Refer to the GitHub Security Advisory GHSA-ccfx-mfmx-2fx9 for detailed technical analysis of the affected code paths.

Detection Methods for CVE-2026-44899

Indicators of Compromise

Markdown content containing Image directives with :width: or :height: values that include semicolons, colons, or CSS property names after a numeric prefix.
Rendered HTML output containing unexpected CSS declarations within style="width:..." or style="height:..." attributes on <img> elements.
Web server logs showing POST requests with Markdown payloads referencing the Image directive and suspicious dimension strings.

Detection Strategies

Audit application logs for Markdown submissions containing :width: or :height: option values with non-numeric trailing characters.
Scan stored Markdown content for Image directives whose dimension values fail strict numeric validation.
Inventory dependencies to identify Python applications importing mistune at versions below 3.2.1.

Monitoring Recommendations

Monitor outbound network requests from rendered Markdown pages for unusual CSS-driven background-image fetches that could indicate data exfiltration.
Track Content Security Policy (CSP) violation reports related to inline styles or external resource loads on pages rendering user-supplied Markdown.
Alert on dependency manifests (requirements.txt, pyproject.toml, Pipfile.lock) that pin Mistune to vulnerable releases.

How to Mitigate CVE-2026-44899

Immediate Actions Required

Upgrade Mistune to version 3.2.1 or later across all Python applications and services.
Audit existing stored Markdown content for malicious Image directives and sanitize or re-render affected entries.
Apply a strict Content Security Policy that restricts inline styles and external CSS resources on pages rendering user-supplied Markdown.

Patch Information

Mistune 3.2.1 contains the official fix. The release tightens validation in the Image directive plugin so that :width: and :height: values are fully anchored numeric inputs. See the Mistune v3.2.1 release notes and the GitHub Security Advisory GHSA-ccfx-mfmx-2fx9 for full details.

Workarounds

Disable the Image directive plugin in Mistune configurations where image dimension options are not required.
Implement a pre-rendering filter that rejects Markdown Image directives containing non-numeric characters in :width: or :height: values.
Enforce a Content Security Policy header such as Content-Security-Policy: default-src 'self'; style-src 'self' to limit the impact of CSS injection.

bash

# Upgrade Mistune to the patched version
pip install --upgrade "mistune>=3.2.1"

# Verify the installed version
python -c "import mistune; print(mistune.__version__)"