CVE-2026-59926: Mistune Markdown Parser XSS Vulnerability

CVE-2026-59926 Overview

CVE-2026-59926 is a Cross-Site Scripting (XSS) vulnerability in Mistune, a Python Markdown parser with renderers and plugins. Versions prior to 3.2.1 fail to escape the :class: option in the Admonition directive before concatenating it into the HTML class attribute. The flaw resides in render_admonition() within src/mistune/directives/admonition.py and enables attribute injection and script execution. The issue persists even when the HTMLRenderer escape mode is enabled, defeating a control that developers commonly rely on. Version 3.2.1 addresses the defect by escaping the offending values before they reach the rendered output. The vulnerability is tracked under CWE-79.

Critical Impact
Attackers can inject arbitrary HTML attributes and JavaScript into rendered Markdown output, allowing XSS against any user viewing attacker-controlled content processed by Mistune.

Affected Products

Mistune Python Markdown parser versions prior to 3.2.1
Applications embedding Mistune with the Admonition directive plugin enabled
Web platforms rendering user-supplied Markdown through Mistune's HTMLRenderer

Discovery Timeline

2026-07-08 - CVE-2026-59926 published to NVD
2026-07-08 - Last updated in NVD database
Version 3.2.1 - Mistune maintainers released patched version via GitHub Release v3.2.1
Advisory published as GHSA-g97x-gvcm-x72h

Technical Details for CVE-2026-59926

Vulnerability Analysis

Mistune's Admonition directive accepts a :class: option that authors use to apply CSS classes to rendered admonition blocks. The render_admonition() function in src/mistune/directives/admonition.py concatenates this user-controlled string directly into the HTML class attribute without HTML entity escaping. An attacker who controls Markdown input can close the class attribute and inject additional attributes such as onmouseover, onerror, or onclick handlers containing JavaScript. Because the injection occurs during HTML construction rather than through the standard text-rendering path, the escape=True setting on HTMLRenderer does not protect against this vector. The same class of defect affected the image/figure directive, where figclass and figwidth values were concatenated into class and style attributes without escaping.

Root Cause

The root cause is missing output encoding for directive option values consumed by attribute contexts. The renderer treated :class: input as trusted structural data instead of untrusted content that requires attribute-context escaping before insertion into HTML.

Attack Vector

Exploitation requires an attacker to submit Markdown containing a crafted Admonition directive to an application that renders it with Mistune below version 3.2.1. When a victim views the rendered page, the injected event handler executes in the victim's browser session, enabling session theft, credential harvesting, or authenticated actions against the hosting application. User interaction (viewing the rendered content) is required.

python

# Patch: src/mistune/directives/admonition.py
from typing import TYPE_CHECKING, Any, Dict, Match
from ..util import escape as escape_text

from ._base import BaseDirective, DirectivePlugin

python

# Patch: src/mistune/directives/image.py
if align:
    _cls += " align-" + align
if figclass:
    _cls += " " + escape_text(figclass)

html = '<figure class="' + _cls + '"'
if figwidth:
    html += ' style="width:' + escape_text(figwidth) + '"'
return html + ">\n" + text + "</figure>\n"

Source: GitHub commit a3cb6e5. The patch imports escape from mistune.util and applies it to every user-controlled value written into an HTML attribute.

Detection Methods for CVE-2026-59926

Indicators of Compromise

Markdown source containing .. admonition:: or .. note:: blocks with :class: values that include quotes, angle brackets, or event handler substrings such as onerror= or onmouseover=
Rendered HTML output where a <div>class attribute contains injected attributes or JavaScript URIs
Requests to endpoints that accept Markdown input followed by outbound requests to attacker-controlled domains from user browsers

Detection Strategies

Scan installed Python dependencies for mistune versions below 3.2.1 using pip list or a Software Composition Analysis tool
Add server-side validation that rejects directive option values containing HTML metacharacters before submission to the renderer
Deploy Content Security Policy (CSP) reporting to surface inline script execution originating from Markdown rendering endpoints

Monitoring Recommendations

Log and alert on Markdown submissions containing directive syntax combined with attribute-injection patterns such as " followed by on
Monitor web application logs for CSP violation reports referencing pages that render user-generated Markdown
Track dependency inventories continuously to flag re-introduction of vulnerable Mistune versions during builds

How to Mitigate CVE-2026-59926

Immediate Actions Required

Upgrade Mistune to version 3.2.1 or later in every environment that renders untrusted Markdown
Audit application code for direct invocation of the Admonition or image directives and confirm the patched build is loaded at runtime
Enforce a strict Content Security Policy that disallows inline event handlers and restricts script sources

Patch Information

The fix is available in Mistune 3.2.1. The patch imports escape from mistune.util and applies it to directive option values before they are concatenated into HTML attributes. See the GitHub Security Advisory GHSA-g97x-gvcm-x72h and release notes for v3.2.1 for full details.

Workarounds

Disable the Admonition and image directive plugins if the application does not require them
Sanitize rendered HTML output with a downstream library such as bleach configured to strip event-handler attributes
Reject Markdown submissions whose directive option values contain characters outside a strict allowlist (for example [A-Za-z0-9_-])

bash

# Upgrade Mistune to the patched release
pip install --upgrade 'mistune>=3.2.1'

# Verify the installed version
python -c "import mistune; print(mistune.__version__)"