Medium severity6.1OSV Advisory· Published Jul 8, 2026· Updated Jul 9, 2026
CVE-2026-59929
CVE-2026-59929
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to reach rendered href and src attributes and potentially execute script in affected user agents. This issue is fixed in version 3.3.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mistunePyPI | < 3.3.0 | 3.3.0 |
Affected products
4Patches
Vulnerability mechanics
References
6- github.com/lepture/mistune/commit/c7101fcbb6e8790e8e39157c5ca2238fc6dd6cbcnvdPatchWEB
- github.com/lepture/mistune/security/advisories/GHSA-qfrw-5rxm-mhh2nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-qfrw-5rxm-mhh2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-59929ghsaADVISORY
- github.com/lepture/mistune/releases/tag/v3.3.0nvdRelease NotesWEB
- github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2217.yamlghsaWEB
News mentions
2- Mistune Project: Nine Vulnerabilities Including DoS and XSS Disclosed TogetherVypr Intelligence · Jul 9, 2026
- Authlib Mistune: Nine Vulnerabilities Including DoS and XSS Disclosed TogetherVypr Intelligence · Jul 9, 2026