In breve
- CVE-2026-59926 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda mistune, mistune (mistune project).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.33%, superiore al 25.8% delle vulnerabilità.
- Correzione: aggiornare a 3.3.0 o successiva.
| Package | Affected versions | Patched versions |
|---|
| mistune PyPI | < 3.3.0
| 3.3.0
|
| mistune | < 3.3.0
| 3.3.0
|
Description
In src/mistune/directives/admonition.py, the render_admonition() function concatenates the :class: option directly into the HTML class attribute without escaping (lines 63-68).
This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used.
The directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.
NVD description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free