PyPI/mistune CVE-2022-34749: unknown, EPSS 1.62%
In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named cat
Action: Upgrade mistune to 2.0.3 or later.
pip install mistune==2.0.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0a1 | 2.0.3 | - |
Fixed versions
| 2.0.3 |
Sources
- osv: PYSEC-2022-237
- https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2
- https://github.com/lepture/mistune/releases
- https://github.com/advisories/GHSA-fw3v-x4f2-v673
CVE-2022-34749 · published · modified · JSON