CVE-2026-59929: Mistune URL Scheme Bypass Vulnerability – XSS Risk in Markdown Parser

Technical summary

The safe_url filter in Mistune's HTML renderer implements an allowlist-style block for dangerous URL schemes, but the implementation is incomplete. It restricts only javascript:, vbscript:, file:, and data: schemes—omitting a broader set of dangerous legacy and protocol-chained schemes (feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res:). An attacker can craft Markdown content with hrefs or src attributes using these unblocked schemes. When the Markdown is rendered to HTML and displayed in a user agent that interprets these schemes, arbitrary script execution becomes possible. The vulnerability is rooted in an incomplete understanding of the full namespace of exploitable URL schemes across different browsers and user agents.

Business impact

Organizations relying on Mistune to sanitize user-generated or untrusted Markdown content face elevated XSS risk. If your application renders Markdown from user input and displays it to other users—common in comment systems, wikis, collaborative platforms, or documentation tools—an attacker can inject malicious payloads that execute in the browsers of your users. This could lead to session hijacking, credential theft, malware distribution, or defacement. The impact depends on the sensitivity of the application and the trust level of the Markdown sources.

Affected systems

Mistune versions prior to 3.3.0 are affected. This includes all 3.2.x and earlier releases. Any Python application using Mistune to render Markdown without additional external sanitization is at risk. Applications that already implement additional URL scheme validation (e.g., using external HTML sanitizers like Bleach) may have partial or complete protection depending on their configuration.

Exploitability

Exploitation requires user interaction (clicking a link or visiting a page with the malicious Markdown) and depends on the user agent's handling of the unblocked schemes. Browsers have varying levels of support for legacy schemes, making the exploit reliability inconsistent across client environments. The CVSS score of 6.1 (Medium) reflects the need for user interaction and the context-dependent nature of exploitation, though the attack surface can be broad in applications that process large volumes of user-generated Markdown.

Remediation

Upgrade Mistune to version 3.3.0 or later, which corrects the safe_url filter to block a comprehensive set of dangerous URL schemes. Additionally, consider implementing defense-in-depth by layering a secondary HTML sanitization library (such as Bleach or Nh3) on top of Mistune's output. This ensures that even if Mistune's filtering is incomplete, a stricter allowlist-based sanitizer provides additional protection.

Patch guidance

Update your Mistune dependency to version 3.3.0 or later. In requirements.txt or setup.py, change mistune to mistune>=3.3.0. After updating, test your Markdown rendering pipeline to ensure no regressions in legitimate content display. Verify that links and image sources in your test corpus still render correctly.

Detection guidance

Monitor for Markdown content containing URLs with schemes like feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, or res: attributes. Automated scanning of user-submitted Markdown or comments for these patterns can flag suspicious submissions. Review browser console logs and user reports of unexpected script execution on pages displaying Markdown. If using a web application firewall (WAF), configure rules to detect or block these scheme patterns in request payloads.

Why prioritize this

While the CVSS score is Medium, the practical risk depends on your application's use case. Prioritize this highly if you: (1) render user-generated Markdown to other users, (2) lack secondary sanitization layers, or (3) operate in high-trust or sensitive environments. Prioritize it moderately if Markdown sources are internal or trusted, or if you already employ additional HTML sanitization. The incomplete scheme list makes this a subtle but persistent vulnerability.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a network-based attack requiring no privileges, low attack complexity, but mandatory user interaction and cross-site scope implications. It carries confidentiality and integrity impact but no availability impact. The score appropriately penalizes the requirement for user action while acknowledging the broad scope of potential affected users and the ability to compromise sensitive information or deface content.

Frequently asked questions