Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, the render_figure() function concatenates the figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used, because these values bypass the inline renderer. Version 3.2.1 contains a patch.

The vulnerability affects Lepture Mistune, version 3.2.0 and earlier, which is widely used to render Markdown content in Python web applications.

The CVSS score of 5.3 indicates moderate severity, and the combination of user‑controlled Markdown input and the lack of escaping means that an attacker who can supply malicious figure directives can run arbitrary scripts in a victim's browser. The EPSS score is < 1%, indicating a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, but any web application rendering user‑supplied Markdown with Mistune exposes a realistic XSS vector. The primary attack vector is a crafted Markdown document that includes a figure directive with specially crafted figclass or figwidth values.