Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2026-59929: Mistune Markdown parser allows unsafe URL schemes
CVE-2026-59929 · published 3 months ago
Summary
The Mistune markdown tool (used in several Linux packages) could let specially crafted links use older or combined URL types like feed: or view-source: that bypass its safety check. This could cause a web page to run unwanted scripts when the link is clicked. Update Mistune to version 3.3.0 or later to restore proper protection.
What to do
- Update hsiaoming yang mistune to version 3.3.0.
- Update mistune_project mistune to version 3.3.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | lepture | mistune | < 3.3.0 |
| Debian:11 | debian | mistune | All versions |
| Debian:12 | debian | mistune | All versions |
| Debian:13 | debian | mistune | All versions |
| Debian:14 | debian | mistune | All versions |
| pip | hsiaoming yang | mistune |
< 3.3.0 Fix: upgrade to 3.3.0
|
| – | mistune_project | mistune |
< 3.3.0 cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | mistune | All versions |
Original advisory text
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to reach rendered href and src attributes and potentially execute script in affected user agents. This issue is fixed in version 3.3.0.
References
- https://security-tracker.debian.org/tracker/CVE-2026-59929 Vendor Advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-221...
- https://github.com/advisories/GHSA-qfrw-5rxm-mhh2
- https://nvd.nist.gov/vuln/detail/CVE-2026-59929 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-59929 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-59929 Third Party Advisory
- https://github.com/lepture/mistune/releases/tag/v3.3.0 URL
- https://github.com/lepture/mistune/security/advisories/GHSA-qfrw-5rxm-mhh2 Vendor Advisory
- https://github.com/lepture/mistune/commit/c7101fcbb6e8790e8e39157c5ca2238fc6dd6c... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59929... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
CWE-184Incomplete List of Disallowed Inputs
Timeline
Published8 Jul 2026
Updated4 Nov 2026
First seen8 Jul 2026
Sources
DEBIAN-CVE-2026-59929 · OSV
CVE-2026-59929 · NVD
CVE-2026-59929 · MITRE
GHSA-qfrw-5rxm-mhh2 · GHSA
UBUNTU-CVE-2026-59929 · OSV
CVE-2026-59929 · OSV
Track software like this
Free during beta