PyPI/mistune CVE-2026-44899: medium 4.7, EPSS 0.23%

Mistune Image Directive CSS Injection Vulnerability

Action: Upgrade mistune to 3.2.1 or later.

pip install mistune==3.2.1

Affected

Fixed versions

Sources

• osv: GHSA-ccfx-mfmx-2fx9
• https://github.com/lepture/mistune/security/advisories/GHSA-ccfx-mfmx-2fx9
• https://nvd.nist.gov/vuln/detail/CVE-2026-44899
• https://github.com/lepture/mistune
• https://github.com/lepture/mistune/releases/tag/v3.2.1

CVE-2026-44899 · published 2026-05-14T16:36:18Z · modified 2026-07-13T07:26:45.210699576Z · JSON