<div class="container">
<h1>Security update for python-mistune</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:22655-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-07-14T10:41:18Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271082">bsc#1271082</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271117">bsc#1271117</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271119">bsc#1271119</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271121">bsc#1271121</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271125">bsc#1271125</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271127">bsc#1271127</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271128">bsc#1271128</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271131">bsc#1271131</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271132">bsc#1271132</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-44896.html">CVE-2026-44896</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-59922.html">CVE-2026-59922</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-59923.html">CVE-2026-59923</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-59924.html">CVE-2026-59924</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-59925.html">CVE-2026-59925</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-59926.html">CVE-2026-59926</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-59927.html">CVE-2026-59927</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-59928.html">CVE-2026-59928</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-59929.html">CVE-2026-59929</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-59930.html">CVE-2026-59930</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44896</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44896</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44896</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44896</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59922</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59922</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59922</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59923</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59923</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59923</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59924</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59924</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59924</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59925</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59925</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59925</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59926</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59926</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59926</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59926</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59927</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59927</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59927</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59928</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59928</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59928</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59929</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59929</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59930</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-59930</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves 10 vulnerabilities can now be installed.</p>
<h2>Description:</h2>
<p>This update for python-mistune fixes the following issues</p>
<ul>
<li>CVE-2026-59922: quadratic-time parsing on long runs of some markers in <code>formatting.py</code> can lead to DoS (bsc#1271117).</li>
<li>CVE-2026-59923: <code>HTMLRenderer.safe_url()</code> does not block percent-encoded javascript URIs and allows for XSS
(bsc#1271119).</li>
<li>CVE-2026-59924: improper processing of user-supplied include paths in <code>Include.parse()</code> can lead to path traversal
and arbitrary file reads (bsc#1271121).</li>
<li>CVE-2026-59925: quadratic-time parsing on long runs of some emphasis pairs in <code>inline_parser</code> can lead to DoS
(bsc#1271125).</li>
<li>CVE-2026-59926: improper escaping in <code>render_admonition()</code> can lead to atribute injection and XSS (bsc#1271127).</li>
<li>CVE-2026-59927: uncontrolled recursion when processing two markdown files that include each other can lead to a DoS
(bsc#1271128).</li>
<li>CVE-2026-59928: quadratic-time parsing on long lists of repeated reference-link definitions in <code>block_parser</code> can
lead to DoS (bsc#1271131).</li>
<li>CVE-2026-59929: HARMFUL_PROTOCOLS list misses legacy and chained schemes and allow arbitrary script execution in
user agents (bsc#1271132).</li>
<li>CVE-2026-59930: the <code>toc</code> plugin and <code>TableOfContents</code> directive generate heading IDs with predictable values and
allow for collisions with attacker-controlled <code>id="toc_N"</code> content (bsc#1271082).</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1243=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1243=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>
<li>python313-mistune-3.1.3-160000.5.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
<ul>
<li>python313-mistune-3.1.3-160000.5.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-44896.html">https://www.suse.com/security/cve/CVE-2026-44896.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-59922.html">https://www.suse.com/security/cve/CVE-2026-59922.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-59923.html">https://www.suse.com/security/cve/CVE-2026-59923.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-59924.html">https://www.suse.com/security/cve/CVE-2026-59924.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-59925.html">https://www.suse.com/security/cve/CVE-2026-59925.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-59926.html">https://www.suse.com/security/cve/CVE-2026-59926.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-59927.html">https://www.suse.com/security/cve/CVE-2026-59927.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-59928.html">https://www.suse.com/security/cve/CVE-2026-59928.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-59929.html">https://www.suse.com/security/cve/CVE-2026-59929.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-59930.html">https://www.suse.com/security/cve/CVE-2026-59930.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271082">https://bugzilla.suse.com/show_bug.cgi?id=1271082</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271117">https://bugzilla.suse.com/show_bug.cgi?id=1271117</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271119">https://bugzilla.suse.com/show_bug.cgi?id=1271119</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271121">https://bugzilla.suse.com/show_bug.cgi?id=1271121</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271125">https://bugzilla.suse.com/show_bug.cgi?id=1271125</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271127">https://bugzilla.suse.com/show_bug.cgi?id=1271127</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271128">https://bugzilla.suse.com/show_bug.cgi?id=1271128</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271131">https://bugzilla.suse.com/show_bug.cgi?id=1271131</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271132">https://bugzilla.suse.com/show_bug.cgi?id=1271132</a>
</li>
</ul>
</div>