Mistune 3.2.1 up to just before 3.3.0 contains a flaw that lets an attacker supply arbitrary markdown and inject CSS through the unvalidated figwidth option of the figure directive. The injected CSS can include statements such as background:url(), causing a victim browser to request a resource from an attacker‑controlled domain and potentially revealing existing style attribute values. This mechanism does not execute arbitrary code but can leak data or trigger unintended external requests.

All Mistune releases from 3.2.1 to the latest patch before 3.3.0 are affected because they contain the unvalidated figwidth option. Versions 3.3.0 and later incorporate a fix that validates or removes this option, eliminating the vulnerability.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and the CAF is not listed in the CISA KEV catalog, so the probability of real‑world exploitation is unknown. The likely attack vector is when an application accepts user‑supplied markdown content; based on the description, it is inferred that the attacker must be able to control the markdown input. If this condition is met, an attacker can inject malicious CSS that may exfiltrate data or trigger unintended external requests, with a higher risk in public or content‑management systems that expose the figure directive to users.