Mistune CVE-2026-59926

Exploitation requires three concurrent conditions: (1) the target application uses Mistune with the directives/admonition plugin active, as the flaw is strictly isolated to render_admonition() in src/mistune/directives/admonition.py - applications not using admonition directives are not affected; (2) attacker-controlled input can supply Markdown admonition blocks containing a :class: option; and (3) the rendered HTML output is served to and viewed in a web browser by another user (stored XSS) or reflected back to the submitter (reflected XSS). Exploitation is limited by the mandatory user interaction requirement - a victim must load or interact with the rendered page (UI:P in CVSS 4.0). Applications that render Markdown exclusively server-side without exposing HTML to browsers, or that block or sanitize admonition :class: values at ingestion, are not exploitable. Authentication level of the attacker varies by application design and is not constrained by the vulnerability itself.

The CVSS 4.0 score of 5.3 (Medium) reflects network-reachable, low-complexity, zero-privilege exploitation requiring passive victim interaction (UI:P). Real-world impact is highly context-dependent: stored XSS scenarios in multi-user platforms (wikis, CMS, documentation tools, code review systems) represent a materially higher priority than single-user or offline rendering contexts where output is never served to other browsers. No CISA KEV listing and no known public exploit are confirmed, suggesting the vulnerability has not yet been actively weaponized at scale. EPSS data was not provided, so exploitation probability cannot be quantified beyond CVSS signal. Impact is bounded to browser-side code execution (VC:L/VI:L, SC:L/SI:L in CVSS 4.0); there is no server-side foothold. The escape-bypass characteristic elevates practical risk beyond the raw score: defenders who audited for escape mode usage would have falsely cleared this attack surface.

An attacker submits a crafted Markdown document to a Mistune-powered wiki or documentation platform containing an admonition block with a malicious :class: value such as " onmouseover="alert(document.cookie)", which closes the class attribute and injects an event handler. When Mistune renders this Markdown and the resulting HTML is served to a victim user who loads the page, the injected JavaScript executes in the victim's browser context, enabling theft of session tokens or redirection to a phishing page. No public POC has been identified, but the technique requires only rudimentary knowledge of HTML attribute injection.