Technical impact
Mistune, a Python Markdown parser, has a flaw that allows an attacker to trigger a RecursionError by supplying Markdown with an excessively long sequence of consecutive asterisk characters. The parser creates deeply nested emphasis tokens from these characters, and the recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit, causing the process to crash. This failure results in a denial of service that can affect any application that relies on Mistune to render Markdown content.
Affected Systems
The affected product is the Mistune parser by the lepture organization. Versions 3.3.0 through 3.3.2 contain the vulnerability; these revisions are used in various Python projects that perform Markdown to HTML conversion.
Risk and Exploitability
The CVSS score of 7.5 indicates a high availability impact. The EPSS score is below 1%, suggesting low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could trigger the flaw by submitting crafted Markdown to any application that processes untrusted content with Mistune. The exploit would cause the parsing process to crash immediately, leading to service disruption.
Github GHSA