Kurz gesagt
- CVE-2026-59926 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in mistune, mistune (mistune project).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.33%, höher als bei 25.8% aller Schwachstellen.
- Abhilfe: auf 3.3.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| mistune PyPI | < 3.3.0
| 3.3.0
|
| mistune | < 3.3.0
| 3.3.0
|
Description
In src/mistune/directives/admonition.py, the render_admonition() function concatenates the :class: option directly into the HTML class attribute without escaping (lines 63-68).
This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used.
The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.
NVD description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free