CVE-2026-121437 — Vulnerability intelligence
lepture — mistune
Published:
- CVSS
- 8.7
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "*a_b" to trigger an O(n²) index-fixup loop, stalling workers for seconds.