Catálogo de CVE

CVE-2026-44898

Mistune is a Python Markdown parser with renderers and…

[Catálogo de CVE]

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a <ul> table-of-contents tree from a list of (level, id, text) tuples. Both the id value (used as href="#<id>") and the text value (used as the visible link label) are inserted into <a> tags via a plain Python format string — with no HTML escaping applied to either value. When heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the href="#..." attribute context, injecting arbitrary HTML tags including <script> blocks directly into the rendered TOC. This vulnerability is fixed in 3.2.1.

Gravidade
Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.23% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiansidmistune3.3.4-1FixedDistribution-reported fixed boundary[CVE-2026-44898]
Debiansidmistune3.4.0-1Fixed[CVE-2026-44898]

Showing 2 fix observations. All 12 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedmistuneNot reportedUnknownSource applicability is not establishedProvider not reported
PyPIRelease not reportedmistune3.2.1UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedmistune3.2.1UnknownSource applicability is not establishedProvider not reported
DebianbookwormmistuneNot reportedAffectedDistribution reports no fix[CVE-2026-44898]
Debianbookwormmistune2.0.4-1Affected[CVE-2026-44898]
DebianforkymistuneNot reportedAffectedDistribution reports no fix[CVE-2026-44898]
Debianforkymistune3.1.4-1Affected[CVE-2026-44898]
Debiansidmistune3.3.4-1FixedDistribution-reported fixed boundary[CVE-2026-44898]
Debiansidmistune3.4.0-1Fixed[CVE-2026-44898]
DebiantrixiemistuneNot reportedAffectedDistribution reports no fix[CVE-2026-44898]
Debiantrixiemistune3.1.3-1Affected[CVE-2026-44898]
Suselinux enterprise module for python 3 15 sp7python-mistune2.0.5-150400.11.8.1UnknownSource applicability is not established[SUSE-SU-2026:2949-1]
Original provider fields
{
  "package_releases": [
    {
      "name": "mistune",
      "status": "fixed",
      "release": "sid",
      "version": "3.4.0-1"
    },
    {
      "name": "mistune",
      "status": "vulnerable",
      "release": "forky",
      "version": "3.1.4-1"
    },
    {
      "name": "mistune",
      "status": "vulnerable",
      "release": "trixie",
      "version": "3.1.3-1"
    },
    {
      "name": "mistune",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "2.0.4-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1138260,
      "name": "mistune",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "3.3.4-1"
    },
    {
      "bug": 1138260,
      "name": "mistune",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1138260,
      "name": "mistune",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1138260,
      "name": "mistune",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "mistune",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "mistune",
      "fixed_version": "3.2.1",
      "applicability_unknown": true
    },
    {
      "name": "mistune",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.1"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "3.2.1",
      "applicability_unknown": true
    },
    {
      "name": "python-mistune",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5-150400.11.8.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for python 3 15 sp7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:2949-1",
      "fixed_version": "2.0.5-150400.11.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:2949-1",
      "provider_updated_at": "2026-07-15T10:00:06.155958260Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1138260]

Publisher notes

[trixie] mistune: Minor issue [bookworm] mistune: Minor issue

OpenFactory catalog packages

A associação de pacotes está em andamento.

[Debian 12 (Bookworm)]

  • [python3-mistune]Desconhecido

    Pacote fonte: [mistune]

    Detalhes (2)

    • 2.0.4-1 · all · bookworm

      Afetada

      nvd · mistune · debian · bookworm; nvd · mistune · debian · 12

    • 2.0.4-1 · all · bookworm

      Afetada

      nvd · mistune · debian · bookworm; nvd · mistune · debian · 12

[Debian 13 (Trixie)]

  • [python3-mistune]Desconhecido

    Pacote fonte: [mistune]

    Detalhes (2)

    • 3.1.3-1 · all · trixie

      Afetada

      nvd · mistune · debian · 13

    • 3.1.3-1 · all · trixie

      Afetada

      nvd · mistune · debian · 13

Observado:

Referências

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]