Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-59930: Mistune Markdown parser lets attackers spoof heading IDs
CVE-2026-59930 · published 3 months ago
Summary
The Mistune Markdown tool creates heading identifiers using simple numbers like toc_1, toc_2, etc., without checking the actual heading text. An attacker could insert their own element with the same identifier, causing the page to jump to the wrong place or interfere with styles and scripts. Upgrade Mistune to version 3.3.0 or later to get the corrected, safer identifier generation.
What to do
- Update hsiaoming yang mistune to version 3.3.0.
- Update mistune_project mistune to version 3.3.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | lepture | mistune | < 3.3.0 |
| Debian:11 | debian | mistune | All versions |
| Debian:12 | debian | mistune | All versions |
| Debian:13 | debian | mistune | All versions |
| Debian:14 | debian | mistune | All versions |
| Ubuntu:16.04:LTS | canonical | mistune | All versions |
| Ubuntu:18.04:LTS | canonical | mistune | All versions |
| Ubuntu:20.04:LTS | canonical | mistune | All versions |
| Ubuntu:22.04:LTS | canonical | mistune | All versions |
| Ubuntu:24.04:LTS | canonical | mistune | All versions |
| Ubuntu:25.10 | canonical | mistune | All versions |
| Ubuntu:26.04:LTS | canonical | mistune | All versions |
| pip | hsiaoming yang | mistune |
< 3.3.0 Fix: upgrade to 3.3.0
|
| – | mistune_project | mistune |
< 3.3.0 cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:* |
Original advisory text
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id="toc_N" content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.
References
- https://security-tracker.debian.org/tracker/CVE-2026-59930 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-59930 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-59930 Third Party Advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-221...
- https://github.com/advisories/GHSA-2hm2-hc3v-44h9
- https://nvd.nist.gov/vuln/detail/CVE-2026-59930 Vendor Advisory
- https://github.com/lepture/mistune/releases/tag/v3.3.0 URL
- https://github.com/lepture/mistune/security/advisories/GHSA-2hm2-hc3v-44h9 Vendor Advisory
- https://github.com/lepture/mistune/commit/c4093c4742ed0d10d9332fb8edb455869b7b58... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59930... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-345Insufficient Verification of Data Authenticity
CWE-1284Improper Validation of Specified Quantity in Input
Timeline
Published8 Jul 2026
Updated29 Oct 2026
First seen8 Jul 2026
Sources
DEBIAN-CVE-2026-59930 · OSV
UBUNTU-CVE-2026-59930 · OSV
CVE-2026-59930 · NVD
CVE-2026-59930 · MITRE
GHSA-2hm2-hc3v-44h9 · GHSA
CVE-2026-59930 · OSV
Track software like this
Free during beta