Mistune's HTMLRenderer.heading() method constructs heading tags by concatenating the id attribute value directly into the HTML without escaping or sanitization. When a custom heading_id callback returns raw heading text containing double quotes, it breaks out of the id attribute, allowing injection of arbitrary attributes such as event handlers. The default TOC hook generates safe numeric IDs, but real-world usage often derives IDs from heading text, making this a practical XSS vector. The vulnerability is confirmed with a proof of concept that injects an onmouseover JavaScript event. The issue affects adr-viewer versions >=1.3.0 and <1.4.0_5. A patch is available.

An attacker who can control heading text in adr-viewer can inject arbitrary HTML attributes into the heading's id attribute, enabling cross-site scripting (XSS). This can lead to execution of malicious JavaScript in the context of users viewing the rendered content, potentially exposing sensitive information or performing unauthorized actions. The default safe ID generation prevents this, but common usage patterns that derive IDs from user-controlled heading text are vulnerable.

A patch is available for adr-viewer to properly escape or sanitize the id attribute value in HTMLRenderer.heading(). Users should update to a fixed version >=1.4.0_5. Avoid using custom heading_id callbacks that return raw heading text without sanitization. If a vendor advisory is available, follow its instructions for upgrading or applying the official fix.