Python Markdown Parser Vulnerability in Mistune Affects Multiple Versions
CVE-2026-44897

6.1MEDIUM

Key Information:

Vendor

Lepture

Status
Mistune
Vendor
CVE Published:
26 May 2026

What is CVE-2026-44897?

Mistune, a popular Python Markdown parser, is susceptible to an HTML injection vulnerability due to improper handling of id attributes in heading elements. In versions prior to 3.2.1, the method HTMLRenderer.heading() concatenates the id attribute value directly into the generated HTML without appropriate sanitization. This opens a doorway for attackers to inject arbitrary attributes into headings, potentially including event handlers or malicious links. Users are encouraged to update to Mistune version 3.2.1 or later to mitigate this risk.

Affected Version(s)

mistune < 3.2.1

References

https://github.com/lepture/mistune/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/lepture/mistune/releases/tag/v3.2.1
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.