Medium severity6.1OSV Advisory· Published Jul 8, 2026· Updated Jul 9, 2026
CVE-2026-59926
CVE-2026-59926
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mistunePyPI | < 3.3.0 | 3.3.0 |
Affected products
4cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*range: <3.3.0
- (no CPE)range: <3.2.1
Patches
Vulnerability mechanics
References
6- github.com/lepture/mistune/commit/a3cb6e5655308797e8be021d6c7b5bab13cbace2nvdPatchWEB
- github.com/advisories/GHSA-g97x-gvcm-x72hghsaADVISORY
- github.com/lepture/mistune/security/advisories/GHSA-g97x-gvcm-x72hnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-59926ghsaADVISORY
- github.com/lepture/mistune/releases/tag/v3.2.1nvdRelease NotesWEB
- github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2214.yamlghsaWEB
News mentions
2- Mistune Project: Nine Vulnerabilities Including DoS and XSS Disclosed TogetherVypr Intelligence · Jul 9, 2026
- Authlib Mistune: Nine Vulnerabilities Including DoS and XSS Disclosed TogetherVypr Intelligence · Jul 9, 2026