Merged
Fix CVE-2026-59923 in python-mistune #36
Fix CVE-2026-59923 in python-mistune #36
Merged
G7egHNAdd on Aug 18
G7egHN
G7egHN
Aug 18

Backport the upstream URL scheme validation fix for CVE-2026-59923.

Mistune 2.0.4 checked harmful URL schemes before decoding percent escapes. Encoded javascript and data URIs were emitted into rendered HTML. The patch decodes URLs up to three times before scheme validation and adds regression tests.

Validation:

  • Patch applies cleanly to mistune 2.0.4
  • Before: encoded javascript/data URI is emitted
  • After: href/src is replaced with #harmful-link
  • Focused unit tests pass
  • git diff --check passes
  • Official openEuler score: 6.1 (Medium)
  • Target product status: Affected / No solution or patch
likedislike
Pull Request has been successfully merged by openeuler-ci-bot.
(Thank you for G7egHN's contribution.)
G7egHNG7egHN
Aug 18 Created pull request, commit efc10722
openeuler-ci-botopeneuler-ci-botCollaborators
Aug 18 Set shinwell_hu,yangzhao_kl as approver
openeuler-ci-botopeneuler-ci-botCollaborators
Aug 18 Added label: sig/sig-python-modules
openeuler-ci-bot
openeuler-ci-botCollaborators
Aug 18 Comments:

Welcome To openEuler Community

Hey @G7egHN , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: sig-python-modules ,
and any of the maintainers: @shinwell_hu, @yangzhao_kl ,
and any of the committers: @cherry530, @randy1568, @starlet-dx .

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Aug 18 Comments:

当前仓库存在以下 保护分支 :

Protected Branch Version Release
master 3.3.4 1
openEuler-26.09-DevStation 3.3.3 1
openEuler-26.09 3.3.3 1
openEuler-24.03-LTS-SP4 2.0.4 2
openEuler-24.03-LTS-SP3 2.0.4 2
openEuler-24.03-LTS-SP1 2.0.4 2
openEuler-24.03-LTS-Next 2.0.4 2
openEuler-22.03-LTS-SP4 0.8.3 8
openEuler-20.03-LTS-SP4 0.8.3 7
oepkg_openstack-train_oe-20.03-LTS-SP1 0.8.3 7
revert-merge-9-master 0.8.3 9
revert-merge-12-master 0.8.3 9
openEuler-EPOL-LTS 0.8.3 6
20.09 0.8.3 6

评论 /sync <branch1> <branch2> ... 可将当前 PR 修改同步到其它分支(创建同步 PR):
a) 如果当前 PR 是 Open 状态,同步操作将延迟到 PR 被合并时执行
b) 如果当前 PR 已经 Merged,将立即执行同步操作

注意:

  1. /sync 命令可以指定同步到多个分支,仅最后一个 /sync 命令生效
  2. 如果创建的同步 PR 不正确,可通过向同步 PR 的源分支提交轻量级 PR 完善,或使用 /close 命令关闭
likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Aug 18 Added label: openeuler-cla/yes
openeuler-ci-bot
openeuler-ci-botCollaborators
Aug 18 Comments:

门禁正在运行, 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决,可参考门禁指导手册
门禁入口及编码规范检查: multiarch/src-openeuler/trigger/python-mistune/14/console

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Aug 18 Added label: ci_processing
G7egHN
G7egHN
Aug 18 Comments:

/check-cla

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Aug 18 Removed label: openeuler-cla/yes
openeuler-ci-botopeneuler-ci-botCollaborators
Aug 18 Added label: openeuler-cla/yes
openeuler-ci-bot
openeuler-ci-botCollaborators
Aug 18 Comments:

CLA Signature Pass

G7egHN, thanks for your pull request. All authors of the commits have signed the CLA. 👍

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Aug 18 Comments:

x86_64架构构建及构建后检查:multiarch/src-openeuler/x86-64/python-mistune/14/console

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Aug 18 Comments:

aarch64架构构建及构建后检查:multiarch/src-openeuler/aarch64/python-mistune/14/console

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Aug 18 Removed label: ci_processing
openeuler-ci-bot
openeuler-ci-botCollaborators
Aug 18 Comments:
Check Name Build Result 详情 Build Details
check_binary_file ✅SUCCESS #14
check_lfsconfig ☑️EXCLUDE
check_package_yaml_file ✅SUCCESS
check_repo_in_maintain ✅SUCCESS
check_consistency ✅SUCCESS
check_spec_file ✅SUCCESS
x86_64 check_build ✅SUCCESS #14
check_install ✅SUCCESS
check_license ✅SUCCESS
aarch64 check_build ✅SUCCESS #14
check_install ✅SUCCESS
check_license ✅SUCCESS
likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Aug 18 Added label: ci_successful
openeuler-ci-bot
openeuler-ci-botCollaborators
Aug 18 Comments:

如下为接口变更检查结果,目标分支为openEuler-24.03-LTS-SP4,请PR提交者check差异信息

Arch Name Check Items Rpm Name Check Result Build Details
compare_package(x86_64) add_rpms ✅SUCCESS #14
delete_rpms ✅SUCCESS
rpm_files ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
compare_package(aarch64) add_rpms ✅SUCCESS #14
delete_rpms ✅SUCCESS
rpm_files ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
Aug 18 Comments:
likedislike
木得感情的openEuler机器人
木得感情的openEuler机器人Collaborators
Aug 19 Comments:

/lgtm

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Aug 19 Added label: lgtm
openeuler-ci-bot
openeuler-ci-botCollaborators
Aug 19 Comments:

Review Code Feedback

  • The label lgtm was added to this pull request. It means that shinwell_hu reviewed the code changes. 👋
Tips
  • If this pull request is not merged while all conditions are met, comment /check-pr to try again. 😄
likedislike
木得感情的openEuler机器人
木得感情的openEuler机器人Collaborators
Aug 19 Comments:

/approve

likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Aug 19 Added label: approved
openeuler-ci-bot
openeuler-ci-botCollaborators
Aug 19 Comments:

Review Code Feedback

  • The label approved was added to this pull request. It means that shinwell_hu reviewed the code changes. 👋
Tips
  • If this pull request is not merged while all conditions are met, comment /check-pr to try again. 😄
likedislike
openeuler-ci-botopeneuler-ci-botCollaborators
Aug 19 Merged pull request, merge node SHA: 67a8ca205eed50441b71a3d96290c8ed2b475b92
xu_pingCollaborators
26 days ago Comments:

/sync openEuler-24.03-LTS-Next openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3

likedislike
openeuler-ci-bot
openeuler-ci-botCollaborators
26 days ago Comments:

In response to this:

/sync openEuler-24.03-LTS-Next openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3

@cherry530

同步操作执行结果:

Branch Status Pull Request
openEuler-24.03-LTS-Next 创建同步 PR https://gitcode.com/src-openeuler/python-mistune/merge_requests/41
openEuler-24.03-LTS-SP1 创建同步 PR https://gitcode.com/src-openeuler/python-mistune/merge_requests/42
openEuler-24.03-LTS-SP3 创建同步 PR https://gitcode.com/src-openeuler/python-mistune/merge_requests/43
likedislike