Vulnerabilities in lepture
28 resultsCVE-2026-59928HIGHMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsEPSS 0.7%CVE-2026-59925HIGHinline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsEPSS 0.6%CVE-2026-59922HIGHMistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)EPSS 0.6%CVE-2026-121437HIGHMistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimitersEPSS 0.6%CVE-2026-33079HIGHMistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titlesEPSS 0.6%CVE-2026-59927MEDIUMMistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown filesEPSS 0.5%CVE-2026-49851HIGHMistune: Potential DoS via quadratic-time parsing in parse_link_textEPSS 0.5%CVE-2026-76098HIGHMistune has Denial of Service — RecursionError via Excessive Emphasis Markers in MarkdownEPSS 0.5%CVE-2026-115354HIGHMistune before 3.3.0 Arbitrary Local File Read via Include DirectiveEPSS 0.5%CVE-2026-59924MEDIUMMistune: Arbitrary File Read via Include directive path traversalEPSS 0.5%CVE-2026-115355HIGHMistune before 3.3.0 Path Traversal and XSS via Include DirectiveEPSS 0.5%CVE-2026-115352HIGHMistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline ParserEPSS 0.4%CVE-2026-115348HIGHMistune before 3.3.0 Quadratic-Time DoS via parse_link_textEPSS 0.4%CVE-2026-115347HIGHMistune before 3.3.0 Quadratic Denial of Service via parse_link_textEPSS 0.4%CVE-2026-115353CRITICALMistune before 3.3.0 Path Traversal via include DirectiveEPSS 0.4%CVE-2026-59923MEDIUMMistune: XSS via percent-encoded javascript URI bypass in safe_url()EPSS 0.3%CVE-2026-115349HIGHMistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket ParsingEPSS 0.3%CVE-2026-59929MEDIUMMistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` executionEPSS 0.3%CVE-2026-59926MEDIUMMistune: XSS via unescaped class option in Admonition directiveEPSS 0.3%CVE-2026-121438MEDIUMMistune before 3.3.3 Denial of Service via Balanced Bracket Link ParsingEPSS 0.3%