cbcvebase.
CVE-2026-59926
published 2026-07-08

CVE-2026-59926: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the…

PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.19%
9.0th percentile
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
lepturemistune< 3.2.13.2.1
mistune_projectmistune< 3.3.03.3.0
mtamta-solution-server-rhel9——
rhoaiodh-pipeline-runtime-datascience-cpu-py312-rhel9——
rhoaiodh-pipeline-runtime-minimal-cpu-py312-rhel9——
rhoaiodh-pipeline-runtime-pytorch-cuda-py312-rhel9——
rhoaiodh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9——
rhoaiodh-pipeline-runtime-pytorch-rocm-py312-rhel9——
rhoaiodh-pipeline-runtime-tensorflow-cuda-py312-rhel9——
rhoaiodh-pipeline-runtime-tensorflow-rocm-py312-rhel9——
rhoaiodh-th06-cpu-torch210-py312-rhel9——
rhoaiodh-th06-cpu-torch291-py312-rhel9——
rhoaiodh-th06-cuda130-torch210-py312-rhel9——
rhoaiodh-th06-cuda130-torch291-py312-rhel9——
rhoaiodh-th06-rocm64-torch291-py312-rhel9——
rhoaiodh-workbench-jupyter-datascience-cpu-py312-rhel9——
rhoaiodh-workbench-jupyter-minimal-cpu-py312-rhel9——
rhoaiodh-workbench-jupyter-minimal-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-minimal-rocm-py312-rhel9——
rhoaiodh-workbench-jupyter-pytorch-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-pytorch-rocm-py312-rhel9——
rhoaiodh-workbench-jupyter-tensorflow-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-tensorflow-rocm-py312-rhel9——
rhoaiodh-workbench-jupyter-trustyai-cpu-py312-rhel9——

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.