CVE-2026-59930: Mistune Python Markdown XSS Vulnerability

CVE-2026-59930 Overview

CVE-2026-59930 is a data authenticity vulnerability [CWE-345] in Mistune, a Python Markdown parser with renderers and plugins. Versions prior to 3.3.0 generate heading anchor IDs in the toc plugin and TableOfContents directive as predictable toc_N values without slugifying the heading text. Attacker-controlled Markdown content containing elements with id="toc_N" can collide with generated anchors. The collision redirects same-page navigation, CSS selectors, and JavaScript event handlers to attacker-supplied elements. The maintainers fixed the issue in Mistune 3.3.0.

Critical Impact
Attackers submitting Markdown content can hijack heading anchor targets, redirecting in-page navigation and DOM selectors to attacker-controlled elements on pages that render user-supplied Markdown with the toc plugin.

Affected Products

Mistune Python Markdown parser versions prior to 3.3.0
Applications using the Mistune toc plugin to render untrusted Markdown
Applications using the Mistune TableOfContents directive

Discovery Timeline

2026-07-08 - CVE-2026-59930 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59930

Vulnerability Analysis

Mistune's toc plugin generates identifiers for heading anchors using a sequential counter pattern of toc_0, toc_1, toc_2, and so on. The generator does not slugify the heading text, and it does not check whether the resulting identifier collides with IDs already present in the rendered document.

When a rendering pipeline processes attacker-supplied Markdown, the attacker can embed raw HTML or Markdown constructs that produce elements with the same toc_N identifiers. The DOM then contains duplicate IDs. Browsers resolve fragment navigation, document.getElementById, and #toc_N CSS selectors to the first matching element, which can be the attacker-controlled node instead of the legitimate heading.

The impact is limited to integrity of client-side navigation and selector resolution. The Mistune 3.3.0 release introduces slugified, content-derived anchor IDs to eliminate the predictable pattern.

Root Cause

The root cause is insufficient verification of data authenticity [CWE-345] in anchor ID generation. The plugin trusts that no other element in the rendered output will use the toc_N pattern, but that assumption fails when untrusted Markdown is rendered. The fix in commit c4093c4 imports re and updates src/mistune/toc.py to derive anchor IDs from heading text.

Attack Vector

Exploitation requires an attacker to submit Markdown content that a target application renders with the toc plugin enabled, and a victim user must load the resulting page. The attacker crafts Markdown that produces HTML elements with id="toc_0", id="toc_1", or similar identifiers. Same-page anchor links and scripts bound by ID then resolve to the attacker's element.

python

# Patch excerpt from src/mistune/toc.py (Mistune 3.3.0)
+import re
 from typing import TYPE_CHECKING, Any, Callable, Dict, Iterable, List, Optional, Tuple

 from .core import BlockState
# Source: https://github.com/lepture/mistune/commit/c4093c4742ed0d10d9332fb8edb455869b7b581b
# The fix introduces regex-based slugification so anchor IDs derive from heading
# text rather than a predictable toc_N counter, eliminating collisions with
# attacker-controlled id attributes in rendered Markdown.

Detection Methods for CVE-2026-59930

Indicators of Compromise

Rendered HTML output containing multiple elements sharing id="toc_0", id="toc_1", or other toc_N identifiers
User-submitted Markdown containing raw HTML tags with id attributes matching the toc_N pattern
Client-side navigation events resolving #toc_N fragments to non-heading elements

Detection Strategies

Inventory Python applications and scan requirements.txt, pyproject.toml, and poetry.lock files for mistune versions below 3.3.0
Add a post-render validation step that parses generated HTML and flags duplicate id attributes
Log Markdown submissions that include raw HTML id attributes matching the toc_\d+ pattern for review

Monitoring Recommendations

Monitor content management systems, documentation portals, and comment platforms that render user Markdown with mistune
Track dependency updates through software composition analysis to detect regression to pre-3.3.0 versions
Alert on anomalous client-side navigation patterns where fragment links resolve to non-heading DOM nodes

How to Mitigate CVE-2026-59930

Immediate Actions Required

Upgrade Mistune to version 3.3.0 or later in all Python applications that render Markdown
Audit rendering pipelines that use the toc plugin or TableOfContents directive for untrusted input
Sanitize user-supplied Markdown to strip raw HTML id attributes before rendering when a version upgrade is not immediately possible

Patch Information

The fix ships in Mistune 3.3.0. Review the GitHub Security Advisory GHSA-2hm2-hc3v-44h9 and the remediation commit c4093c4 for details. The v3.3.0 release notes document the anchor ID generation change.

Workarounds

Disable the toc plugin and TableOfContents directive when processing untrusted Markdown
Apply an HTML sanitizer such as bleach after rendering to strip attacker-controlled id attributes matching toc_\d+
Post-process rendered HTML to detect and deduplicate colliding element IDs before serving pages to users

bash

# Upgrade Mistune to the patched version
pip install --upgrade 'mistune>=3.3.0'

# Verify the installed version
python -c "import mistune; print(mistune.__version__)"