Mistune CVE-2026-59930

Three specific conditions must all be met: (1) The application must use Mistune's toc plugin or TableOfContents directive - applications using Mistune for basic Markdown rendering without this plugin are not affected. (2) The attacker must be able to inject raw HTML content into the Markdown that Mistune processes - if the application pre-sanitizes or escapes HTML within Markdown input, the id attribute required for the collision cannot be introduced. (3) A user must interact with the page by clicking a table-of-contents navigation link or triggering a CSS/JavaScript selector targeting the hijacked ID (UI:R per CVSS vector). The CVSS PR:N metric reflects that content submission in many public-facing applications (comment systems, open wikis, documentation platforms) requires no authenticated session, though application-level authentication for content submission would constrain the attacker pool.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) appropriately characterizes this as a moderate-severity integrity issue. The network attack vector reflects that crafted Markdown can be submitted remotely; user interaction (UI:R) is required because a victim must load the page and navigate within it for the hijack to have effect. There is no confidentiality or availability impact. No EPSS score was supplied in the input data - exploitation probability cannot be quantified from available signals. The CVE carries no CISA KEV listing and no public exploit code has been identified, indicating no confirmed active exploitation. Real-world risk is further bounded by three compounding preconditions: the toc plugin must be enabled, the attacker must be able to inject raw HTML into the rendered content, and a user must interact with the affected page. Applications that sanitize HTML within Markdown input or that do not expose the toc plugin are not affected. This is a genuine but contextually narrow integrity risk, not a broad network-exploitable critical flaw despite the network attack vector.

An attacker submitting Markdown content to a web application that renders it with Mistune's toc plugin enabled includes a raw HTML element such as <span id='toc_0'>malicious anchor</span> early in the document body. When a legitimate heading is processed, Mistune assigns it id='toc_0', but the browser resolves TOC link clicks to the earlier injected element instead, redirecting users to an unexpected page location or triggering a JavaScript handler bound to that selector. No public exploit code has been identified, but the attack requires only knowledge of the sequential ID scheme.