Quick answers
- Is CVE-2026-59930 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59930 being exploited in the wild.
- How severe is CVE-2026-59930?
- Medium severity, with a CVSS score of 4.3, published 8 July 2026.
- Which products and versions are affected?
- mistune (PyPI) < 3.3.0, ECOSYSTEM:introduced=0,fixed=3.3.0.
- Is there a fix for CVE-2026-59930?
- Yes. mistune (PyPI): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-59930 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-59930?
- Check whether you run mistune (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mistune (PyPI): upgrade to 3.3.0 or later
pip install "mistune>=3.3.0"
Technical details
The Mistune 'toc' plugin and 'TableOfContents' directive use a predictable identifier generation scheme for heading IDs, defaulting to a simple 'toc_N' format based on document position rather than content. An attacker who can influence the document content (e.g., through unsanitized HTML or specific directives) can inject elements with matching IDs earlier in the DOM. This causes a collision where browsers, CSS, and JavaScript selectors may prioritize the attacker's element over the legitimate heading. This can be used to hijack internal anchor navigation, redirect click handlers, or break ARIA associations. The issue is fixed in version 3.3.0 by implementing text-based slugification for IDs.
Affected products
- lepture mistune < 3.3.0
Identifiers
- CVE-2026-59930
- GHSA-2hm2-hc3v-44h9
- PYSEC-2026-2218
Timeline
- 2026-06-21: disclosed
- 2026-07-20: advisory
- 2026-07-20: patched: Fixed in version 3.3.0