CVE-2026-115351 lepture CVE debrief

Who should care

Defenders responsible for markdown processing and rendering contexts, such as developers and security teams, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-115351 is a CSS injection vulnerability in Mistune versions 3.2.1 before 3.3.0, allowing attackers to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Defenders should prioritize verifying and upgrading to Mistune version 3.3.0 or later, and assess exposure in markdown processing and rendering contexts.

• Potential for attackers to inject malicious styles and leak attribute values
• Possible exploitation via crafted markdown input
• Need for verification and remediation efforts in markdown processing and rendering contexts

Technical summary

The vulnerability allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive, potentially forcing victim browsers to send requests to attacker servers and leak attribute values. This is a CSS injection vulnerability in Mistune versions 3.2.1 before 3.3.0, which affects markdown processing and rendering contexts. Defenders should prioritize verifying and upgrading to Mistune version 3.3.0 or later, and assess exposure in markdown processing and rendering contexts.

Defensive priority

Defenders should prioritize verifying and upgrading to Mistune version 3.3.0 or later, and assess exposure in markdown processing and rendering contexts.

Recommended defensive actions

• Verify and upgrade to Mistune version 3.3.0 or later
• Assess exposure in markdown processing and rendering contexts
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and references to vendor advisories and third-party advisories. The evidence is limited to the information provided in the CVE record and source item, and defenders should verify the vulnerability and its impact on their systems. The CVE record was published on 2026-10-22T19:13:27.678Z and has not been modified since then. There are references to vendor advisories and third-party advisories that provide additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.