Mistune CVE-2026-49851

The only prerequisite is that the target application passes attacker-controlled Markdown to Mistune's parser (any code path reaching parse_link_text) using a version earlier than 3.3.0; the malicious input is simply Markdown containing many consecutive '[' characters. No special configuration, plugin, or non-default mode is required, and per the CVSS vector (PR:N/UI:N/AT:N) no authentication, user interaction, or additional attack requirement is needed - exploitation works against default behavior. The practical limiting factor is exposure: the bug is only reachable where untrusted Markdown is rendered, so deployments that parse only trusted/internal content, that already impose strict input-size caps or rendering timeouts, or that have upgraded to 3.3.0 are not at risk.

The CVSS 4.0 score of 8.7 (High) reflects AV:N/AC:L/AT:N/PR:N/UI:N with availability-only impact (VA:H, VC/VI:N), i.e., a fully remote, unauthenticated, low-complexity attack whose sole consequence is service disruption - no confidentiality or integrity loss. This is a credible and easily realized risk wherever Mistune parses attacker-influenced Markdown, since the payload is small and the quadratic blow-up is deterministic rather than probabilistic. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the source data, so exploitation-probability signals are absent; the practical severity is bounded by the fact that impact is limited to resource exhaustion and is typically recoverable once the request is killed or rate-limited. Net: a genuine priority for any internet-facing service that renders untrusted Markdown, but a lower priority for purely internal/trusted-input deployments. Note the score is availability-weighted - the 8.7 should not be read as implying any code-execution or data-exposure risk.

An attacker submits a comment, chat message, issue body, or API payload containing a short string of many consecutive '[' characters to a web service that renders it with a pre-3.3.0 Mistune. The server spends quadratic CPU time in parse_link_text on that single small request, and by sending a handful of such requests concurrently the attacker exhausts available cores and degrades or halts service for legitimate users. No public exploit code is identified, but the payload is trivial to craft and requires no authentication, special timing, or user interaction.