CVE-2026-59930 Details
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id="toc_N" content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.
A vulnerability exists in the Mistune Markdown parser, specifically in versions through 3.2.1, within the TOC plugin and TableOfContents directive. These components generate heading IDs in a predictable manner, using a simple 'toc_N' format based on the order of headings, without incorporating any text from the headings themselves. This flaw allows an attacker to inject HTML with an 'id' attribute matching the generated 'toc_N' IDs, creating conflicts that can disrupt navigation, interfere with CSS selectors, or manipulate JavaScript event handlers. The issue arises because the default ID generation method ignores heading content, leading to potential collisions when documents are rendered together or when attacker-controlled headings are inserted into trusted content.
Users can upgrade to Mistune version 3.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lepture/mistune/security/advisories/GHSA-2hm2-hc3v-44h9 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/lepture/mistune/commit/c4093c4742ed0d10d9332fb8edb455869b7b581b | [email protected] | Patch |
| https://github.com/lepture/mistune/releases/tag/v3.3.0 | [email protected] | Release Notes |
| https://github.com/lepture/mistune/security/advisories/GHSA-2hm2-hc3v-44h9 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mistune project mistune | < 3.3.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |