Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Lepture
Mistune

lepture/mistune: Functions Patched by CVE Fixes

python

#412 of 500 repositories

lepture/mistune

Functions and files changed by CVE fixes in this repository.

Latest located fix August 24, 2026

14

CVE fixes located

Published CVEs

72

Functions patched

Distinct function sites

22

Files patched

Distinct source files

2017–2026

Years covered

By CVE publication date

Overview

14 published CVEs have a fix traced to functions in lepture/mistune, the earliest published in 2017. Those fixes changed 72 distinct functions across 22 files, in 139 patch hunks.

Among the 500 repositories tracked here, lepture/mistune ranks #412 by the number of CVEs with a located fix.

Most patched functions

Functions in lepture/mistune changed by the most CVE fixes.

1__init__src/mistune/inline_parser.py2 CVEs · 2 patches2026
2render_html_includesrc/mistune/directives/include.py2 CVEs · 1 patches2026
3parsesrc/mistune/directives/include.py2 CVEs · 1 patches2026
4_unquote_urlsrc/mistune/renderers/html.py2 CVEs · 1 patches2026
5safe_urlsrc/mistune/renderers/html.py2 CVEs · 1 patches2026
6block_errorsrc/mistune/renderers/html.py2 CVEs · 1 patches2026
7render_admonitionsrc/mistune/directives/admonition.py2 CVEs · 1 patches2026
8render_figuresrc/mistune/directives/image.py2 CVEs · 1 patches2026
9autolinkmistune.py1 CVEs · 2 patches2017
10escape_linkmistune.py1 CVEs · 2 patches2017
11_process_emphasis_delimiterssrc/mistune/inline_parser.py1 CVEs · 1 patches2026
12parsesrc/mistune/inline_parser.py1 CVEs · 1 patches2026
13_emphasis_depthsrc/mistune/inline_parser.py1 CVEs · 1 patches2026
14_finalize_emphasis_tokenssrc/mistune/inline_parser.py1 CVEs · 1 patches2026
15_find_next_blank_linesrc/mistune/block_parser.py1 CVEs · 1 patches2026

Most patched files

Files in lepture/mistune changed by the most CVE fixes.

1src/mistune/renderers/html.py4 CVEs · 4 functions
2src/mistune/inline_parser.py2 CVEs · 13 functions
3src/mistune/block_parser.py2 CVEs · 11 functions
4mistune.py2 CVEs · 4 functions
5src/mistune/directives/include.py2 CVEs · 2 functions
6src/mistune/directives/admonition.py2 CVEs · 1 functions
7src/mistune/directives/image.py2 CVEs · 1 functions
8src/mistune/list_parser.py1 CVEs · 6 functions
9src/mistune/core.py1 CVEs · 5 functions
10src/mistune/plugins/formatting.py1 CVEs · 5 functions

Fix size

How much code a CVE fix in lepture/mistune changes, with backports counted once.

26

Median lines changed

Added plus removed, per CVE

43%

Fixes of 20 lines or fewer

Share of CVE fixes

0%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in lepture/mistune, and the functions each fix changed.

Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
CVE-2026-76098_emphasis_depth _process_emphasis_delimiters _finalize_emphasis_tokens
High · CVSS 7.5
EPSS 0.5%2026-08-24
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
CVE-2026-59927parse render_html_include
Medium · CVSS 5.3
EPSS 0.5%2026-07-08
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
CVE-2026-59928_find_next_blank_line parse_ref_link
High · CVSS 7.5
EPSS 0.7%2026-07-08
Mistune: Arbitrary File Read via Include directive path traversal
CVE-2026-59924parse render_html_include
Medium · CVSS 5.9
EPSS 0.5%2026-07-08
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
CVE-2026-59929_unquote_url HTMLRenderer safe_url
Medium · CVSS 6.1
EPSS 0.3%2026-07-08
inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
CVE-2026-59925_get_rule_start_chars _parse_list_item _get_previous_paragraph
High · CVSS 7.5
EPSS 0.6%2026-07-08
Mistune: XSS via unescaped class option in Admonition directive
CVE-2026-59926render_figure block_error render_admonition
Medium · CVSS 5.3
EPSS 0.3%2026-07-08
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
CVE-2026-59923_unquote_url HTMLRenderer safe_url
Medium · CVSS 6.1
EPSS 0.3%2026-07-08
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
CVE-2026-59930_find_html_ids add_toc_hook toc_hook
Medium · CVSS 4.3
EPSS 0.2%2026-07-08
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
CVE-2026-59922_find_end_marker _parse_to_end parse_strikethrough
High · CVSS 7.5
EPSS 0.6%2026-07-08
Mistune: XSS via unescaped figclass/figwidth in Figure directive
CVE-2026-44896render_figure block_error render_admonition
Medium · CVSS 5.3
EPSS 0.3%2026-05-26
Mistune vulnerable to catastrophic backtracking
CVE-2022-34749InlineParser parse_emphasis
High · CVSS 8.8
EPSS 1.6%2022-07-25

Get an alert for each new lepture/mistune CVE, with the patched functions and AI-written analysis.

Monitor mistune CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

AcademySoftwareFoundation/OpenImageIO14 CVEs ail-project/ail-framework14 CVEs android.googlesource.com/platform-external-libhevc14 CVEs apostrophecms/apostrophe14 CVEs assimp/assimp14 CVEs authzed/spicedb14 CVEs bigtreecms/BigTree-CMS14 CVEs canonical/lxd14 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in lepture/mistune.

How many CVEs have a located fix in lepture/mistune?: 14 published CVEs have a fix traced to functions in lepture/mistune, touching 72 functions across 22 files.
Which function in lepture/mistune has been patched by the most CVEs?: __init__ in src/mistune/inline_parser.py has been changed by 2 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in lepture/mistune?: The median fix changes 26 lines. 43% of fixes change 20 lines or fewer, and 0% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

lepture/mistune on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track lepture/mistune CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References