CVE-2026-44898
published 2026-05-26CVE-2026-44898: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a table-of-contents tree from a list of (level, id…
PriorityP430medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.23%
13.6th percentile
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a table-of-contents tree from a list of (level, id, text) tuples. Both the id value (used as href="#") and the text value (used as the visible link label) are inserted into tags via a plain Python format string — with no HTML escaping applied to either value. When heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the href="#..." attribute context, injecting arbitrary HTML tags including blocks directly into the rendered TOC. This vulnerability is fixed in 3.2.1.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lepture | mistune | < 3.2.1 | 3.2.1 |
| mistune_project | mistune | < 3.2.1 | 3.2.1 |
| mistune_project | mistune | >= 3.2.0 < 3.2.1 | 3.2.1 |
| mta | mta-solution-server-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
lepture mistune up to 3.2.0 Python Markdown Parser render_toc_ul ID cross site scripting (GHSA-6269-cqxg-mhhv)
vuldb·2026-05-26·CVSS 6.1
CVE-2026-44898 [MEDIUM] lepture mistune up to 3.2.0 Python Markdown Parser render_toc_ul ID cross site scripting (GHSA-6269-cqxg-mhhv)
A vulnerability was found in lepture mistune up to 3.2.0 and classified as problematic. Impacted is the function render_toc_ul of the component Python Markdown Parser. Such manipulation of the argument ID leads to cross site scripting.
This vulnerability is referenced as CVE-2026-44898. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
Mistune TOC Anchor Injection XSS
ghsa·2026-05-14
CVE-2026-44898 [MEDIUM] CWE-79 Mistune TOC Anchor Injection XSS
Mistune TOC Anchor Injection XSS
## Summary
`render_toc_ul()` builds a `` table-of-contents tree from a list of `(level, id, text)` tuples. Both the `id` value (used as `href="#"`) and the `text` value (used as the visible link label) are inserted into `` tags via a plain Python format string — with no HTML escaping applied to either value.
When heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the `href="#..."` attribute context, injecting arbitrary HTML tags including `` blocks directly into the rendered TOC.
This vulnerability is closely related to H2 (unescaped `id=` in `heading()`): the same `heading_id` callback pattern that triggers H2 also populates the `toc_items` l
Red Hat
mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering
vendor_redhat·2026-05-26·CVSS 6.1
CVE-2026-44898 [MEDIUM] CWE-79 mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering
mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a table-of-contents tree from a list of (level, id, text) tuples. Both the id value (used as href="#") and the text value (used as the visible link label) are inserted into tags via a plain Python format string — with no HTML escaping applied to either value. When heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the href="#..." attribute context, injecting arbitrary HTML tags including blocks directly into the rendered TOC. This vulnerability is fixed in 3.2.1.
A flaw was found in M
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-44898 python-mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering [fedora-all]
bugzilla·2026-06-17·CVSS 6.1
CVE-2026-44898 [MEDIUM] CVE-2026-44898 python-mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering [fedora-all]
CVE-2026-44898 python-mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44898 python-mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering [epel-all]
bugzilla·2026-06-17·CVSS 6.1
CVE-2026-44898 [MEDIUM] CVE-2026-44898 python-mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering [epel-all]
CVE-2026-44898 python-mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44898 python-mistune08: Mistune: Arbitrary code execution via HTML injection in table of contents rendering [epel-all]
bugzilla·2026-06-17·CVSS 6.1
CVE-2026-44898 [MEDIUM] CVE-2026-44898 python-mistune08: Mistune: Arbitrary code execution via HTML injection in table of contents rendering [epel-all]
CVE-2026-44898 python-mistune08: Mistune: Arbitrary code execution via HTML injection in table of contents rendering [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44898 mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering
bugzilla·2026-05-26·CVSS 6.1
CVE-2026-44898 [MEDIUM] CVE-2026-44898 mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering
CVE-2026-44898 mistune: Mistune: Arbitrary code execution via HTML injection in table of contents rendering
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a table-of-contents tree from a list of (level, id, text) tuples. Both the id value (used as href="#") and the text value (used as the visible link label) are inserted into tags via a plain Python format string — with no HTML escaping applied to either value. When heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the href="#..." attribute context, injecting arbitrary HTML tags including blocks directly into the rendered TOC. This vulnerability is fixed in 3.2.1.
2026-05-26
Published