HIGH

CVE-2026-115348

lepture — mistune

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.

CVSS7.5

EPSS0.4%

Exploit StatusNot Assessed

PublishedOct 22, 2026

Last ModifiedOct 23, 2026

Vendorlepture

Productmistune

Weakness (CWE)CWE-400

View on NVD

Vulnerability Timeline

PublishedOct 22, 2026

Last ModifiedOct 23, 2026

Seraph Context

Technology Watch Match

Available for technologies you monitor inside Seraph CTI.

Relevant Threat Actors

Surfaced automatically when a documented actor is linked to this CVE.

Sector Context

Shown when this vendor/product is relevant to your industry.

Exploitation Context

Campaign and indicator context, where Seraph analysts have published it.

References

More from lepture in the catalogue.

CVE-2026-121438mistunePublished Nov 03, 2026 CVE-2026-121437mistunePublished Nov 03, 2026 CVE-2026-115355mistunePublished Oct 22, 2026

Does this affect technology you run?

Declare your technology stack inside Seraph CTI and get notified the moment a vulnerability matches it.

Explore Seraph CTI Back to Vulnerability Catalogue