CVE-2026-44897 | BDVDB-2026-335103 Detail

Description#

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string-concatenating the id attribute value directly into the HTML — with no call to escape(), safe_entity(), or any other sanitisation function. A double-quote character " in the id value terminates the attribute, allowing an attacker to inject arbitrary additional attributes (event handlers, src=, href=, etc.) into the heading element. This vulnerability is fixed in 3.2.1.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-05-26Record published in the CVE List.
2. Version 22026-06-01Most recent update recorded in the CVE List.