Mistune Markdown Parser XSS Vulnerability via Unescaped Figure Directives

A cross-site scripting (XSS) vulnerability has been identified in the Mistune Markdown parser, specifically in versions through 3.2.0. The issue arises in the 'render_figure()' function within the 'src/mistune/directives/image.py' file, where the 'figclass' and 'figwidth' options are concatenated directly into HTML attributes without proper escaping. This flaw enables attribute injection and XSS, even when 'HTMLRenderer(escape=True)' is applied, as these unescaped values circumvent the inline renderer. In contrast, other attributes such as 'src', 'alt', and 'style' are correctly escaped, leaving 'figclass' and 'figwidth' vulnerable.

Impact

Exploitation of this vulnerability allows for cross-site scripting (XSS) attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.