CVE-2026-59930: Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
Vulnerability summary
CVE-2026-59930 is a medium (CVSS 4.3) vulnerability in lepture mistune. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.9% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 08-07-2026PublishedVulnerability first disclosed.
- 09-07-2026Last modifiedVulnerability information updated.
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id="toc_N" content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · PypiEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.19% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundMistune
Maturity: poc
Weaknesses
CWE · root cause- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- mistuneAll versions (No fix recorded)
Lepture1 product
- mistune< 3.3.0
Mistune_project1 product
- mistune< 3.3.0
PyPI1 product
- mistune< 3.3.0
Ubuntu1 product
- mistuneAll versions (No fix recorded)
5 vendors · 5 products
References
9 links- github.com/lepture/mistune/security/advisories/GHSA-2hm2-hc3v-44h9X Refsource CONFIRMWEBEVIDENCEREPORTExploitThird Party Advisory
- github.com/lepture/mistune/commit/c4093c4742ed0d10d9332fb8edb455869b7b581bX Refsource MISCWEBFIXPatch
- github.com/lepture/mistunePACKAGE
