CVE-2026-44899
Description
A flaw was found in Mistune, a Python Markdown parser. The Image directive plugin, responsible for handling image dimensions, improperly validates user-supplied input for width and height options. This allows a remote attacker to inject arbitrary CSS into style attributes, potentially leading to information disclosure or other client-side attacks through Cross-site Scripting (XSS).
Statement
Red Hat products ship python-mistune as a dependency for Markdown rendering. This vulnerability exists in the Image directive plugin, which allows CSS injection via improperly validated width and height options. Exploitation requires the attacker to supply crafted Markdown with image directives that use the :width: or :height: options, and the application must use the Image directive plugin, which is not enabled by default in mistune.
Mitigation
Disable or avoid using the Image directive plugin in mistune when processing untrusted Markdown input. Update to mistune 3.2.1 or later where this issue is fixed.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | 6.1 | 4.7 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | Required | Required | Required |
| Scope | Changed | Changed | Changed |
| Confidentiality | Low | Low | Low |
| Integrity Impact | None | Low | None |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
