PT-2026-56512 · Pypi · Mistune

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-59929

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0

Description The safe url filter in src/mistune/renderers/html.py fails to block several legacy or chained URI schemes. While it restricts javascript:, vbscript:, file:, and data:, it allows schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to be included in rendered href and src attributes. This could allow the execution of scripts in affected user agents.

Recommendations Update to version 3.3.0.

Fix

Incomplete List of Disallowed Inputs

XSS

Weakness Enumeration

CWE-184

CWE-79

Related Identifiers

CVE-2026-59929

Affected Products

Mistune

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-59929 · Security Note
• https://github.com/lepture/mistune/releases/tag/v3.3.0 · Note
• https://github.com/lepture/mistune/commit/c7101fcbb6e8790e8e39157c5ca2238fc6dd6cbc · Note
• https://github.com/lepture/mistune/security/advisories/GHSA-qfrw-5rxm-mhh2 · Note
• https://twitter.com/CVEnew/status/2074931624609788243 · Twitter Post
• https://twitter.com/infoflowcloud/status/2074933072114442347 · Twitter Post