mistune CVE-2026-44896

No vendor-released patched version is currently available as of the advisory date. Immediate mitigation requires either: (1) upgrade mistune to a version newer than 3.2.0 once released by the maintainer (monitor the GitHub repository and PyPI for updates); (2) if upgrading is not immediately feasible, disable figure directives entirely by removing or not loading the image directive plugin - this eliminates the attack surface but removes intended markdown functionality; (3) implement a Web Application Firewall (WAF) rule to detect and block markdown containing figure directives with suspicious figclass or figwidth values (e.g., containing quotes, angle brackets, or event handler patterns), though this is a defense-in-depth measure and not a substitute for patching. Additionally, ensure all markdown input is sourced only from trusted users and consider restricting figure directive usage to authenticated/authorized users if feasible within application logic. Monitor the GitHub repository (https://github.com/lepture/mistune) and the GHSA advisory (https://github.com/lepture/mistune/security/advisories/GHSA-58cw-g322-p94v) for patch releases.