Technical impact
Mistune, a pure‑Python Markdown parser, contains a flaw in its inline_parser that triggers a quadratic‑time scan when processing text with long sequences of correctly matched double or triple asterisk emphasis markers around a single character. Each potential opening marker leads the parser to scan forward for a closing marker, causing CPU usage to grow roughly with the square of the input size. An attacker can supply a small Markdown string that follows this pattern, forcing the rendering process to consume excessive computational resources and leading to a denial‑of‑service condition.
Affected Systems
All releases of Lepture Mistune before version 3.3.0 are affected. Any application importing or utilizing Mistune to render user‑supplied Markdown – such as web frameworks, static site generators, CMS plugins, or APIs – may expose the vulnerability when the inline_parser is invoked during rendering. The vulnerability resides in the inline_parser module, so any component that triggers that code could be exploited. (These use cases are inferred from common use patterns of Mistune.)
Risk and Exploitability
The CVSS score of 7.5 denotes a high severity vulnerability, while the EPSS score of less than 1% indicates it is rarely exploited. The flaw is not listed in CISA’s KEV catalog. An attacker does not need privileged access; sending a malicious Markdown payload to any endpoint that forwards text to Mistune is sufficient. Based on the description, the likely attack vector is a crafted Markdown document sent to a public or authenticated endpoint that performs server‑side rendering, which will cause the parsing engine to consume excessive CPU resources.
Github GHSA