https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 10:05:25 +0000 https://vulnerability.circl.lu/vuln/ghsa-6269-cqxg-mhhv <p><strong>Affected:</strong> PyPI: mistune</p> <p>## Summary `render_toc_ul()` builds a `&lt;ul&gt;` table-of-contents tree from a list of `(level, id, text)` tuples. Both the `id` value (used as `href=&#34;#&lt;id&gt;&#34;`) and the `text` value (used as the visible link label) are inserted into `&lt;a&gt;` tags via a plain Python format string — with no HTML escaping applied to either value.</p> <p>When heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the `href=&#34;#...&#34;` attribute context, injecting arbitrary HTML tags including `&lt;script&gt;` blocks directly into the rendered TOC.</p> <p>This vulnerability is closely related to H2 (unescaped `id=` in `heading()`): the same `heading_id` callback pattern that triggers H2 also populates the `toc_items` list that `render_toc_ul()` consumes, meaning both vulnerabilities fire simultaneously in a typical documentation setup.</p> <p>## Details **File:** `src/mistune/toc.py`</p> <p>```python def render_toc_ul(toc): ... for level, k, text in toc: # k = heading id (used verbatim as href fragment) # text = heading text (used verbatim as link label) item = &#39;&lt;a href=&#34;#{}&#34;&gt;{}&lt;/a&gt;&#39;.format(k, text) # Neither k nor text is passed through escape() at any point ```</p> <p>The `k` and `text` values come directly from the `toc_items` list accumulated during parsing. If `k` contains `&#34;` or `&gt;`, the `href` attribute is broken. If `text` contains `&lt;`, raw tags are injected as the visible link content.…</p> <p><strong>Affected:</strong> PyPI: mistune</p> <p>## Summary `render_toc_ul()` builds a `&lt;ul&gt;` table-of-contents tree from a list of `(level, id, text)` tuples. Both the `id` value (used as `href=&#34;#&lt;id&gt;&#34;`) and the `text` value (used as the visible link label) are inserted into `&lt;a&gt;` tags via a plain Python format string — with no HTML escaping applied to either value.</p> <p>When heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the `href=&#34;#...&#34;` attribute context, injecting arbitrary HTML tags including `&lt;script&gt;` blocks directly into the rendered TOC.</p> <p>This vulnerability is closely related to H2 (unescaped `id=` in `heading()`): the same `heading_id` callback pattern that triggers H2 also populates the `toc_items` list that `render_toc_ul()` consumes, meaning both vulnerabilities fire simultaneously in a typical documentation setup.</p> <p>## Details **File:** `src/mistune/toc.py`</p> <p>```python def render_toc_ul(toc): ... for level, k, text in toc: # k = heading id (used verbatim as href fragment) # text = heading text (used verbatim as link label) item = &#39;&lt;a href=&#34;#{}&#34;&gt;{}&lt;/a&gt;&#39;.format(k, text) # Neither k nor text is passed through escape() at any point ```</p> <p>The `k` and `text` values come directly from the `toc_items` list accumulated during parsing. If `k` contains `&#34;` or `&gt;`, the `href` attribute is broken. If `text` contains `&lt;`, raw tags are injected as the visible link content.…</p> https://vulnerability.circl.lu/vuln/ghsa-6269-cqxg-mhhv