Lepture vulnerabilities
28 CVEs and advisories name Lepture as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121438Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing
- CVE-2026-121437Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters
- CVE-2026-115355Mistune before 3.3.0 Path Traversal and XSS via Include Directive
- CVE-2026-115354Mistune before 3.3.0 Arbitrary Local File Read via Include Directive
- CVE-2026-115353Mistune before 3.3.0 Path Traversal via include Directive
- CVE-2026-115352Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
- CVE-2026-115351Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option
- CVE-2026-115350Mistune before 3.3.0 Stored XSS via Include Directive HTML Files
- CVE-2026-115349Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
- CVE-2026-115348Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text
- CVE-2026-115347Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
- CVE-2026-76098Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
- CVE-2026-59927Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
- CVE-2026-59928Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
- CVE-2026-59924Mistune: Arbitrary File Read via Include directive path traversal
- CVE-2026-59929Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
- CVE-2026-59925inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
- CVE-2026-59926Mistune: XSS via unescaped class option in Admonition directive
- CVE-2026-59923Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
- CVE-2026-59930Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
- CVE-2026-59922Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
- CVE-2026-49851Mistune: Potential DoS via quadratic-time parsing in parse_link_text
- CVE-2026-44898Mistune TOC Anchor Injection XSS
- CVE-2026-44897Mistune Heading ID Attribute Injection XSS
- CVE-2026-44708Mistune Math Plugin XSS Escape Bypass
- CVE-2026-44899Mistune Image Directive CSS Injection Vulnerability
- CVE-2026-44896Mistune: XSS via unescaped figclass/figwidth in Figure directive
- CVE-2026-33079Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles