CVE-2026-59923 Details
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version 3.3.0.
A cross-site scripting (XSS) vulnerability exists in the Mistune Markdown parser for Python, specifically in versions through 3.2.0. The issue arises in the HTMLRenderer.safe_url() method, which fails to properly decode percent-encoded JavaScript URIs before checking for harmful URL schemes. This oversight allows attacker-supplied Markdown links or images to bypass URL protections and execute scripts in the rendered HTML. The vulnerability can be exploited by crafting a Markdown link that includes a percent-encoded JavaScript URI, which is then decoded and executed when the link is clicked.
Users should upgrade to Mistune version 3.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lepture/mistune/security/advisories/GHSA-8c25-4j27-2rv3 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/lepture/mistune/commit/c7101fcbb6e8790e8e39157c5ca2238fc6dd6cbc | [email protected] | Patch |
| https://github.com/lepture/mistune/releases/tag/v3.3.0 | [email protected] | Release Notes |
| https://github.com/lepture/mistune/security/advisories/GHSA-8c25-4j27-2rv3 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mistune project mistune | < 3.3.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | New CVE Received | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |