CVE-2026-59929Disclosure(mistune_project / mistune)

LOWCVSS 6.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch mistune_project mistune systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to reach rendered href and src attributes and potentially execute script in affected user agents. This issue is fixed in version 3.3.0.

mistune_project CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/lepture/mistune/commit/c7101fcbb6e8790e8e39157c5ca2238fc6dd6cbc

Exploit / PoC references

https://github.com/lepture/mistune/security/advisories/GHSA-qfrw-5rxm-mhh2

Other references

https://github.com/lepture/mistune/releases/tag/v3.3.0

Weakness type (CWE)

CWE-79CWE-184

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mistune

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-07-08); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

mistune_project

Products

mistune

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-08	2	Disclosure1General1
2026-07-21	1	Disclosure1

Full discourse3 posts

CVE@CVEnew92d
Disclosure
CVE-2026-59929 Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, vbscript… https://www.cve.org/CVERecord?id=CVE-2026-59929
Post summary
The tweet notes that Mistune's safe_url filter in versions before 3.3.0 only blocks javascript: and vbscript, indicating a vulnerability that was addressed in later releases.
00001786
57.8K followersView on X
DailyCVE@dailycve79d
Disclosure
🟠 Mistune (#Python Markdown Parser), URL Scheme Filter Bypass XSS, #CVE-2026-59929 (Medium) -DC-Jul2026-1106 https://dailycve.com/mistune-python-markdown-parser-url-scheme-filter-bypass-xss-cve-2026-59929-medium-dc-jul2026-1106/
Post summary
The post announces CVE‑2026‑59929, a medium‑severity XSS flaw in Mistune’s URL scheme filter, but provides no PoC, exploit details, active exploitation evidence, or patch information.
0000046
220 followersView on X
Infoflowcloud@infoflowcloud92d
General
🚨*CVE* CVE-2026-59929 Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, vbscript… https://www.cve.org/CVERecord?id=CVE-2026-59929 ----- Traducción: CVE-2026-59929 Mis… http://infoflow.cloud`
Post summary
The post offers a brief technical note on CVE-2026-59929, describing a flaw in Mistune’s safe_url filter that only blocks certain protocols prior to version 3.3.0.
0000043
91 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mistune_project	mistune	-	-	-

Explore more

Back to dashboard mistune_project CVEs mistune vulnerabilities