Medium5.4Red Hat Linux

Medium [CVE-2026-59926] Cross-Site Scripting via unescaped HTML class attribute in Admonition directive

This medium-severity Red Hat Linux advisory covers CVE-2026-59926 affecting Migration Toolkit for Applications 8, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4.

CVE-2026-59926 Published Jul 8, 2026Updated by vendor Jul 8, 2026

CVE-2026-59926

Affected products & platforms

Red Hat LinuxUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive:class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled.

This issue is fixed in version 3.2.1. A remote attacker could exploit this by providing specially crafted input, leading to the execution of arbitrary script code in the user's browser.

This Moderate flaw in the Mistune Markdown parser allows for Cross-Site Scripting (XSS) due to improper sanitization of user-controlled input within the Admonition directive's class attribute. This vulnerability requires user interaction with malicious content for successful exploitation.

Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Weakness: CWE-79.

Affected Red Hat products: Migration Toolkit for Applications 8; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4. Under investigation: Red Hat Satellite 6.

Red Hat does not currently list a fixing RHSA for this CVE.

Affected versions

< 3.2.1

Official advisory · high-confidence parse· fetched 10 days ago·verify at source

Fixed versions

3.2.1

Official advisory · high-confidence parse· fetched 10 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

To mitigate this issue, avoid processing untrusted or unvalidated Markdown content with affected versions of the Mistune library. Implement robust input validation and sanitization for any user-provided Markdown before rendering to prevent the injection of malicious attributes or scripts.

Official advisory · high-confidence parse· fetched 10 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.