{"id":"CVE-2026-115351","title":"mistune: mistune: Information disclosure via CSS injection in figure directive (CVE-2026-115351)","summary":"A flaw was found in mistune. A remote attacker with control over markdown content can cause information disclosure by performing Cascading Style Sheets (CSS) injection through the unvalidated figwidth option in the figure directive. By ins…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","cvssSource":"vendor","cwe":["CWE-79","CWE-94"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["openshift_ai_rhoai","openshift_container_platform 4"],"published":"2026-10-22","updated":"2026-10-23","sourceUpdated":"2026-10-23T00:22:46+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115351.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115351.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-115351"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559369"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115351"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115351"},{"url":"https://github.com/lepture/mistune/security/advisories/GHSA-xmwc-wjpr-q378"},{"url":"https://www.vulncheck.com/advisories/mistune-3.2.1-before-3.3.0-css-injection-via-figure-directive-figwidth-option"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-22T22:00:50.396Z","epss":0.00221,"epssPercentile":0.12596,"slug":"CVE-2026-115351","body":"## Overview\n\nA flaw was found in mistune. A remote attacker with control over markdown content can cause information disclosure by performing Cascading Style Sheets (CSS) injection through the unvalidated figwidth option in the figure directive. By inserting arbitrary style rules into rendered web pages, the attacker can force a victim's browser to send requests to an external server and leak sensitive data.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115351.json)\n\n**mistune: mistune: Information disclosure via CSS injection in figure directive** — rated Moderate by Red Hat. Released 2026-10-22, updated 2026-10-23.\n\nAffected:\n\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n\nNo fix planned:\n\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFix deferred","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}