PT-2026-39330 · Pypi · Mistune
Across-Verticals-Malaysia
+1
·
Published
2026-05-09
·
Updated
2026-05-26
·
CVE-2026-44897
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
mistune versions prior to 3.2.1
Description
In the
HTMLRenderer.heading() function within src/mistune/renderers/html.py, the id attribute of heading tags is constructed by directly concatenating the value into the HTML without sanitization. When the add toc hook() API is used with a custom heading id callback that returns raw heading text (a common practice for creating human-readable slug anchors), an attacker can inject a double-quote character to terminate the attribute and insert arbitrary HTML attributes, such as event handlers. This allows for the execution of malicious JavaScript when a user interacts with the heading.Recommendations
Update to version 3.2.1 or later.
As a temporary workaround, ensure that any custom callback passed to
add toc hook() independently sanitizes or escapes the heading id value before returning it.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mistune