CVE-2026-115351 in Mistune
Summary
by MITRE • 10/22/2026
Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Mistune versions prior to 3.3.0 represents a significant security flaw within the markdown parsing library, specifically categorized as an HTML injection leading to CSS injection or Cross-Site Scripting via style attributes. This issue stems from insufficient input validation applied to the figwidth option associated with the figure directive during the rendering process. When users provide markdown content that includes figures, the parser processes the width parameter without adequately sanitizing special characters or restricting allowed values. Consequently, an attacker who controls the markdown input can inject arbitrary CSS declarations directly into the style attribute of the rendered HTML element. This lack of strict validation allows for the injection of malicious code snippets such as background:url() which are then embedded within the final output structure.
From a technical perspective, this flaw exploits how web browsers interpret and execute inline styles attached to DOM elements. By injecting a CSS rule that utilizes the url function with an external resource reference, the attacker can manipulate the victim's browser into making HTTP requests to a server under their control. This mechanism is particularly dangerous because it bypasses many traditional content security policies if those policies do not strictly restrict style sources or image loading behaviors. The injected code does not require JavaScript execution privileges in the same way as script-based XSS, yet it achieves similar data exfiltration goals by leveraging standard browser networking capabilities triggered through CSS properties.
The operational impact of this vulnerability is primarily centered on information leakage and potential tracking of user activities. When a victim views the compromised markdown content, their browser automatically attempts to load the specified background image from the attacker-controlled domain. This action results in the transmission of HTTP headers that may contain sensitive session cookies, authentication tokens, or other identifying attributes associated with the current browsing context. Furthermore, this technique can be used for cross-site request forgery scenarios where the mere act of loading a resource triggers side effects on third-party services if those services rely solely on cookie-based authentication without additional CSRF protections. The ability to leak attribute values means that any data embedded in the URL or accessible via standard HTTP headers becomes exposed to the attacker, potentially leading to account takeover or further reconnaissance against the target infrastructure.
This vulnerability aligns with CWE-79 which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting, specifically manifesting through CSS injection vectors rather than direct script execution. It also maps to MITRE ATT&CK technique T1059 Command and Control via Application Layer Protocol where the attacker uses legitimate web protocols like HTTP for data exfiltration by forcing browsers to send requests to external servers. The exploitation path relies on the trust placed in markdown parsers to safely convert text into HTML, highlighting a gap between expected security boundaries and actual implementation safeguards within the library's rendering engine.
To mitigate this risk, organizations using Mistune must upgrade immediately to version 3.3.0 or later where the figwidth option validation has been strengthened to prevent arbitrary CSS injection. For environments unable to update promptly, implementing strict Content Security Policy directives can help limit damage by restricting style sources and image loading origins. Specifically, setting a CSP header with default-src self and img-src restricted to trusted domains will prevent browsers from fetching resources from attacker-controlled servers even if the malicious CSS is injected into the DOM. Additionally, developers should ensure that any markdown processing pipelines apply rigorous output encoding or allow-listing strategies for all dynamic attributes before rendering them in HTML contexts. Regular security audits of third-party libraries and continuous monitoring for new CVEs affecting dependencies are essential practices to maintain a robust defense posture against such injection-based attacks.