CVE-2026-59926
Mistune: XSS via unescaped class option in Admonition directive
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.
| CWE | CWE-79 |
| Vendor | lepture |
| Product | mistune |
| Published | Jul 8, 2026 |
| Last Updated | Jul 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for lepture mistune
Be the first to know when new unknown vulnerabilities affecting lepture mistune are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
lepture / mistune
< 3.2.1