Most recent entries from all

BREW-adr-viewer-CVE-2026-59929 — Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `j…

Affected: Homebrew: adr-viewer

## Summary

**Type:** URL-scheme allowlist gap. The `safe_url` filter only blocks the four schemes `javascript:`, `vbscript:`, `file:`, `data:`. Several other schemes are accepted into rendered `<a href="...">` and `<img src="...">` tags despite being known XSS vectors in legacy or chain-handling browsers. The same gap applies to direct links, reference links, and autolinks. **File:** `src/mistune/renderers/html.py`, line 11-23 (HARMFUL_PROTOCOLS list). **Root cause:** the HARMFUL_PROTOCOLS tuple is a hardcoded, opt-out denylist of four entries. Browsers historically supported (and some still partially support) several other schemes that either execute JavaScript directly (`livescript:`, `mocha:`) or wrap a `javascript:` payload (`feed:javascript:`, `view-source:javascript:`, `jar:javascript:`, `ms-its:javascript:`, `mk:@MSITStore:javascript:`). On user-agents that still recognise these schemes (older Firefox builds for `feed:`/`jar:`, all Internet Explorer / Edge Legacy for `ms-its:`/`mk:`/`res:`, niche chrome-style browsers, browser extensions that register custom protocol handlers), clicking a link rendered by mistune executes attacker-controlled JavaScript in the page's origin.

## Affected Code

**File:** `src/mistune/renderers/html.py`, lines 10-62.

```python class HTMLRenderer(BaseRenderer): HARMFUL_PROTOCOLS: ClassVar[Tuple[str, ...]] = ( "javascript:", "vbscript:", "file:", "data:", )…

EUVD-2026-335377

fkie_cve-2026-59929

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to reach rendered href and src attributes and potentially execute script in affected user agents. This issue is fixed in version 3.3.0.

GHSA-qfrw-5rxm-mhh2 — Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `j…

Affected: PyPI: mistune

## Summary

## Affected Code

**File:** `src/mistune/renderers/html.py`, lines 10-62.

```python class HTMLRenderer(BaseRenderer): HARMFUL_PROTOCOLS: ClassVar[Tuple[str, ...]] = ( "javascript:", "vbscript:", "file:", "data:", )…

openSUSE-SU-2026:21339-1 — Security update for python-mistune

Security update for python-mistune

PYSEC-2026-2217

Affected: PyPI: mistune

SUSE-SU-2026:22655-1 — Security update for python-mistune

Security update for python-mistune

UBUNTU-CVE-2026-59929

Affected: Ubuntu:16.04:LTS: mistune, Ubuntu:18.04:LTS: mistune, Ubuntu:20.04:LTS: mistune, Ubuntu:22.04:LTS: mistune, Ubuntu:24.04:LTS: mistune, Ubuntu:25.10: mistune, Ubuntu:26.04:LTS: mistune