CVE-2026-59930

Katalog CVE

CVSS 4.3 · Medium EPSS 0,19%

Kerentanan Insufficient Verification of Data Authenticity pada mistune project mistune. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id="toc_N" content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.

Rincian

Terbit di NVD

8 Juli 2026

Terakhir diubah

9 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity
CWE-1284: Improper Validation of Specified Quantity in Input

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lepture/mistune/commit/c4093c4742ed0d10d9332fb8edb455869b7b581b patch
• https://github.com/lepture/mistune/security/advisories/GHSA-2hm2-hc3v-44h9 exploit · advisory pihak ketiga
• https://github.com/lepture/mistune/releases/tag/v3.3.0 release notes