Most recent entries from all

CVE-2026-44708 — Mistune Math Plugin XSS Escape Bypass

2026-09-30T21:32:52.612276+00:00

Affected: lepture mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1.

GHSA-8g87-j6q8-g93x — Mistune Math Plugin has an XSS Escape Bypass

2026-09-30T21:32:52.612527+00:00

Affected: PyPI: mistune

## Summary The mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw user-supplied content directly into the HTML output **without any HTML escaping**. This occurs even when the parser is explicitly created with `escape=True`, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.

The result is a silent contract violation: a developer who enables `escape=True` reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer's `_escape` flag entirely.

## Details **File:** `src/mistune/plugins/math.py`

```python def render_inline_math(renderer, text): # `text` is raw user input — no escape() call anywhere return r'$' + text + r"$"

def render_block_math(renderer, text): # same issue for block-level $$...$$ return '

$$\n' + text + "\n$$

\n" ```

Both functions take `text` directly from the parsed token and concatenate it into the output string. Neither function: - calls `escape(text)` from `mistune.util` - checks `renderer._escape` - calls `safe_entity(text)` or any other sanitisation helper

The `escape=True` flag only influences the main `HTMLRenderer` methods (`paragraph`, `heading`, `codespan`, etc.). Plugin render functions registered via `md.renderer.register()` receive the `renderer` instance but have no mechanism that enforces the escape contract -…

PYSEC-2026-2206

2026-09-30T21:32:52.612874+00:00

Affected: PyPI: mistune