Security Advisory
CVE-2026-59923
6.1
MEDIUM
Vulnerability Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version 3.3.0.
Published Date
July 8, 2026
Official Source
NIST NVD Advisory