diff --git a/‎src/mistune/directives/image.py‎
Lines changed: 5 additions & 3 deletions b/‎src/mistune/directives/image.py‎
Lines changed: 5 additions & 3 deletions
diff --git a/‎tests/test_security_image.py‎
Lines changed: 36 additions & 0 deletions b/‎tests/test_security_image.py‎
Lines changed: 36 additions & 0 deletions
@@ -124,9 +124,11 @@ def parse(self, block: "BlockParser", m: Match[str], state: "BlockState") -> Dic
         fig_attrs = {}
         if align:
             fig_attrs["align"] = align
-        for k in ["figwidth", "figclass"]:
-            if k in options:
-                fig_attrs[k] = options[k]
+        figwidth = options.get("figwidth")
+        if figwidth and _num_re.fullmatch(figwidth):
+            fig_attrs["figwidth"] = figwidth
+        if "figclass" in options:
+            fig_attrs["figclass"] = options["figclass"]
 
         children = [{"type": "block_image", "attrs": image_attrs}]
         content = self.parse_directive_content(block, m, state)
 
@@ -0,0 +1,36 @@
+from unittest import TestCase
+
+from mistune import create_markdown
+from mistune.directives import FencedDirective, Figure, Image
+
+
+class TestImageDirectiveSecurity(TestCase):
+    def test_image_directive_rejects_css_dimension_injection(self):
+        md = create_markdown(escape=True, plugins=[FencedDirective([Image()])])
+        html = md(
+            "```{image} x.jpg\n"
+            ":width: 100vw;height:100vh;position:fixed;top:0\n"
+            ":height: 50%\n"
+            ":alt: <alt>\n"
+            "```\n"
+        )
+
+        self.assertIn('alt="&lt;alt&gt;"', html)
+        self.assertIn('style="height:50%;"', html)
+        self.assertNotIn("position:fixed", html)
+
+    def test_figure_directive_escapes_class_and_rejects_figwidth_css_injection(self):
+        md = create_markdown(escape=True, plugins=[FencedDirective([Figure()])])
+        html = md(
+            "```{figure} x.jpg\n"
+            ':figclass: evil" onclick="alert(1)\n'
+            ":figwidth: 10px;position:fixed\n"
+            "\n"
+            "caption\n"
+            "```\n"
+        )
+
+        self.assertIn('class="figure evil&quot; onclick=&quot;alert(1)"', html)
+        self.assertNotIn('onclick="alert(1)"', html)
+        self.assertNotIn("position:fixed", html)
+        self.assertNotIn('style="width:', html)