In short
- CVE-2026-59926 is a MEDIUM (CVSS 6.1) vulnerability affecting mistune, mistune (mistune project).
- Chance of exploitation in the next 30 days (EPSS): 0.33%, higher than 25.8% of all vulnerabilities.
- Fix: update to 3.3.0 or later.
| Package | Affected versions | Patched versions |
|---|
| mistune PyPI | < 3.3.0
| 3.3.0
|
| mistune | < 3.3.0
| 3.3.0
|
Description
In src/mistune/directives/admonition.py, the render_admonition() function concatenates the :class: option directly into the HTML class attribute without escaping (lines 63-68).
This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used.
The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.
NVD description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free