CyberRota Analysis
AI-GeneratedThe vulnerability affects the HTMLRenderer.safe_url() function in Mistune versions prior to 3.3.0, allowing attackers to exploit percent-encoded JavaScript URIs in Markdown links or images. This could lead to the execution of malicious scripts in rendered HTML, posing a security risk to applications using this Markdown parser. Developers and organizations utilizing Mistune for Markdown processing should prioritize upgrading to version 3.3.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version 3.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)