{"id":"CVE-2026-59930","aliases":["PYSEC-2026-2218","GHSA-2hm2-hc3v-44h9"],"title":"Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate hea…","summary":"Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controll…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","vendor":"mistune","product":"mistune","ecosystem":"pip","affected":["mistune < 3.3.0"],"patched":["mistune 3.3.0"],"published":"2026-07-08","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2026-2218","references":[{"url":"https://github.com/lepture/mistune/releases/tag/v3.3.0"},{"url":"https://github.com/lepture/mistune/commit/c4093c4742ed0d10d9332fb8edb455869b7b581b"},{"url":"https://github.com/lepture/mistune/security/advisories/GHSA-2hm2-hc3v-44h9"}],"tags":["osv","pip"],"epss":0.00192,"epssPercentile":0.09106,"ingestedAt":"2026-07-13T18:58:08.256Z","slug":"CVE-2026-59930","body":"## Overview\n\nMistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id=\"toc_N\" content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.\n\n## Affected packages\n\n- `mistune < 3.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mistune 3.3.0`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}