CVE-2026-44898— mistune 跨站脚本漏洞

Mistune TOC Anchor Injection XSS

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a <ul> table-of-contents tree from a list of (level, id, text) tuples. Both the id value (used as href="#<id>") and the text value (used as the visible link label) are inserted into <a> tags via a plain Python format string — with no HTML escaping applied to either value. When heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the href="#..." attribute context, injecting arbitrary HTML tags including <script> blocks directly into the rendered TOC. This vulnerability is fixed in 3.2.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

mistune 跨站脚本漏洞

mistune是Hsiaoming Yang个人开发者的一个快速而强大的 Python Markdown 解析器。 Mistune 3.2.1之前版本存在跨站脚本漏洞，该漏洞源于render_toc_ul()使用Python格式字符串将id和text值插入a标签而未进行HTML转义，攻击者可通过构造包含特殊字符的标题文本，在渲染目录中注入任意HTML标签。

N/A

N/A