Medium severity4.3OSV Advisory· Published Jul 8, 2026· Updated Jul 9, 2026
CVE-2026-59930
CVE-2026-59930
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id="toc_N" content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mistunePyPI | < 3.3.0 | 3.3.0 |
Affected products
4cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*range: <3.3.0
- (no CPE)range: <3.3.0
Patches
Vulnerability mechanics
References
6- github.com/lepture/mistune/commit/c4093c4742ed0d10d9332fb8edb455869b7b581bnvdPatchWEB
- github.com/lepture/mistune/security/advisories/GHSA-2hm2-hc3v-44h9nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-2hm2-hc3v-44h9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-59930ghsaADVISORY
- github.com/lepture/mistune/releases/tag/v3.3.0nvdRelease NotesWEB
- github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2218.yamlghsaWEB
News mentions
2- Mistune Project: Nine Vulnerabilities Including DoS and XSS Disclosed TogetherVypr Intelligence · Jul 9, 2026
- Authlib Mistune: Nine Vulnerabilities Including DoS and XSS Disclosed TogetherVypr Intelligence · Jul 9, 2026