Medium [CVE-2026-59930] Same-page navigation redirection due to predictable heading IDs

Mistune is a Python Markdown parser with renderers and plugins.

Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id="toc_N" content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.

This could lead to unexpected behavior or information disclosure within the application. This flaw has a Moderate impact on Red Hat products that ship mistune 3.x with the toc plugin.

Exploitation requires the attacker to submit Markdown content to a multi-author rendering context where toc is enabled, limiting the practical attack surface. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).

Weakness: CWE-79. Affected Red Hat products: Migration Toolkit for Applications 8; Red Hat OpenShift AI (RHOAI).

Under investigation: Red Hat Satellite 6. Red Hat lists Red Hat OpenShift Container Platform 4 as not affected.

Red Hat does not currently list a fixing RHSA for this CVE.