https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 10:27:56 +0000 https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2026-59930 <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>## Summary</p> <p>**Type:** Predictable identifier generation. The `toc` plugin and `TableOfContents` directive both default to generating heading IDs of the form `toc_1`, `toc_2`, `toc_3`, ... with no input-derived component. An attacker who can place a heading anywhere in the document can predict which `toc_N` ID it will receive, and can inject HTML elsewhere (in a non-heading context) that uses the same `id=&#34;toc_N&#34;` to either (a) shadow the legitimate heading anchor, breaking same-page navigation, or (b) collide with CSS or JavaScript that targets `#toc_N` selectors, redirecting click handlers and styling to attacker-chosen content. **File:** `src/mistune/toc.py` line 36-37 (`heading_id = lambda token, index: &#34;toc_&#34; + str(index + 1)`); `src/mistune/directives/toc.py` line 33 (same default). **Root cause:** the default `heading_id` callback ignores the heading&#39;s text content and uses only the headings&#39;s order in the document. Two documents rendered together (or one document with attacker-influenced headings spliced into trusted content) produce overlapping `toc_N` IDs. Because `id` attribute uniqueness is required by HTML, browsers behaviour on duplicate IDs is undefined; `document.getElementById(&#39;toc_1&#39;)` returns the first match, `getElementsByTagName + querySelector` semantics differ across paths, and CSS rules targeting `#toc_1` apply to whichever element matches first in tree order.</p> <p>## Affected Code</p> <p>**File:** `src/mistune/toc.py`, lines 33-39.</p> <p>```python def add_toc_hook(m…</p> <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>## Summary</p> <p>**Type:** Predictable identifier generation. The `toc` plugin and `TableOfContents` directive both default to generating heading IDs of the form `toc_1`, `toc_2`, `toc_3`, ... with no input-derived component. An attacker who can place a heading anywhere in the document can predict which `toc_N` ID it will receive, and can inject HTML elsewhere (in a non-heading context) that uses the same `id=&#34;toc_N&#34;` to either (a) shadow the legitimate heading anchor, breaking same-page navigation, or (b) collide with CSS or JavaScript that targets `#toc_N` selectors, redirecting click handlers and styling to attacker-chosen content. **File:** `src/mistune/toc.py` line 36-37 (`heading_id = lambda token, index: &#34;toc_&#34; + str(index + 1)`); `src/mistune/directives/toc.py` line 33 (same default). **Root cause:** the default `heading_id` callback ignores the heading&#39;s text content and uses only the headings&#39;s order in the document. Two documents rendered together (or one document with attacker-influenced headings spliced into trusted content) produce overlapping `toc_N` IDs. Because `id` attribute uniqueness is required by HTML, browsers behaviour on duplicate IDs is undefined; `document.getElementById(&#39;toc_1&#39;)` returns the first match, `getElementsByTagName + querySelector` semantics differ across paths, and CSS rules targeting `#toc_1` apply to whichever element matches first in tree order.</p> <p>## Affected Code</p> <p>**File:** `src/mistune/toc.py`, lines 33-39.</p> <p>```python def add_toc_hook(m…</p> https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2026-59930 https://cve.radiocsirt.org/vuln/euvd-2026-335303 EUVD-2026-335303 https://cve.radiocsirt.org/vuln/euvd-2026-335303 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59930 <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id=&#34;toc_N&#34; content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id=&#34;toc_N&#34; content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59930 https://cve.radiocsirt.org/vuln/ghsa-2hm2-hc3v-44h9 <p><strong>Affected:</strong> PyPI: mistune</p> <p>## Summary</p> <p>**Type:** Predictable identifier generation. The `toc` plugin and `TableOfContents` directive both default to generating heading IDs of the form `toc_1`, `toc_2`, `toc_3`, ... with no input-derived component. An attacker who can place a heading anywhere in the document can predict which `toc_N` ID it will receive, and can inject HTML elsewhere (in a non-heading context) that uses the same `id=&#34;toc_N&#34;` to either (a) shadow the legitimate heading anchor, breaking same-page navigation, or (b) collide with CSS or JavaScript that targets `#toc_N` selectors, redirecting click handlers and styling to attacker-chosen content. **File:** `src/mistune/toc.py` line 36-37 (`heading_id = lambda token, index: &#34;toc_&#34; + str(index + 1)`); `src/mistune/directives/toc.py` line 33 (same default). **Root cause:** the default `heading_id` callback ignores the heading&#39;s text content and uses only the headings&#39;s order in the document. Two documents rendered together (or one document with attacker-influenced headings spliced into trusted content) produce overlapping `toc_N` IDs. Because `id` attribute uniqueness is required by HTML, browsers behaviour on duplicate IDs is undefined; `document.getElementById(&#39;toc_1&#39;)` returns the first match, `getElementsByTagName + querySelector` semantics differ across paths, and CSS rules targeting `#toc_1` apply to whichever element matches first in tree order.</p> <p>## Affected Code</p> <p>**File:** `src/mistune/toc.py`, lines 33-39.</p> <p>```python def add_toc_hook(m…</p> <p><strong>Affected:</strong> PyPI: mistune</p> <p>## Summary</p> <p>**Type:** Predictable identifier generation. The `toc` plugin and `TableOfContents` directive both default to generating heading IDs of the form `toc_1`, `toc_2`, `toc_3`, ... with no input-derived component. An attacker who can place a heading anywhere in the document can predict which `toc_N` ID it will receive, and can inject HTML elsewhere (in a non-heading context) that uses the same `id=&#34;toc_N&#34;` to either (a) shadow the legitimate heading anchor, breaking same-page navigation, or (b) collide with CSS or JavaScript that targets `#toc_N` selectors, redirecting click handlers and styling to attacker-chosen content. **File:** `src/mistune/toc.py` line 36-37 (`heading_id = lambda token, index: &#34;toc_&#34; + str(index + 1)`); `src/mistune/directives/toc.py` line 33 (same default). **Root cause:** the default `heading_id` callback ignores the heading&#39;s text content and uses only the headings&#39;s order in the document. Two documents rendered together (or one document with attacker-influenced headings spliced into trusted content) produce overlapping `toc_N` IDs. Because `id` attribute uniqueness is required by HTML, browsers behaviour on duplicate IDs is undefined; `document.getElementById(&#39;toc_1&#39;)` returns the first match, `getElementsByTagName + querySelector` semantics differ across paths, and CSS rules targeting `#toc_1` apply to whichever element matches first in tree order.</p> <p>## Affected Code</p> <p>**File:** `src/mistune/toc.py`, lines 33-39.</p> <p>```python def add_toc_hook(m…</p> https://cve.radiocsirt.org/vuln/ghsa-2hm2-hc3v-44h9 https://cve.radiocsirt.org/vuln/msrc_cve-2026-59930 msrc_CVE-2026-59930 https://cve.radiocsirt.org/vuln/msrc_cve-2026-59930 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21339-1 <p>Security update for python-mistune</p> <p>Security update for python-mistune</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21339-1 https://cve.radiocsirt.org/vuln/pysec-2026-2218 <p><strong>Affected:</strong> PyPI: mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id=&#34;toc_N&#34; content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.</p> <p><strong>Affected:</strong> PyPI: mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id=&#34;toc_N&#34; content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2218 https://cve.radiocsirt.org/vuln/suse-su-2026:22655-1 <p>Security update for python-mistune</p> <p>Security update for python-mistune</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22655-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59930 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mistune, Ubuntu:18.04:LTS: mistune, Ubuntu:20.04:LTS: mistune, Ubuntu:22.04:LTS: mistune, Ubuntu:24.04:LTS: mistune, Ubuntu:25.10: mistune, Ubuntu:26.04:LTS: mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id=&#34;toc_N&#34; content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mistune, Ubuntu:18.04:LTS: mistune, Ubuntu:20.04:LTS: mistune, Ubuntu:22.04:LTS: mistune, Ubuntu:24.04:LTS: mistune, Ubuntu:25.10: mistune, Ubuntu:26.04:LTS: mistune</p> <p>Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id=&#34;toc_N&#34; content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59930