CVE-2026-44897
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
May 26, 2026
CISA due date
—
The record
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string-concatenating the id attribute value directly into the HTML — with no call to escape(), safe_entity(), or any other sanitisation function. A double-quote character " in the id value terminates the attribute, allowing an attacker to inject arbitrary additional attributes (event handlers, src=, href=, etc.) into the heading element. This vulnerability is fixed in 3.2.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-mistune | 0 | 3.2.1-1.1 |
Related vulnerabilities
- CVE-2026-49851 Mistune is a Python Markdown parser with renderers and plugins. Also affects python-mistune
- CVE-2026-33441 Rejected reason: This CVE is a duplicate of another CVE: CVE-2026-33079. Also affects python-mistune
- CVE-2026-33079 In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial… Also affects python-mistune
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79