CVE-2026-59929 is a cross-site scripting (XSS) vulnerability in the Mistune Markdown parser before version 3.3.0. The safe_url filter in src/mistune/renderers/html.py blocked only javascript:, vbscript:, file:, and data: schemes, but allowed other legacy or chained schemes like feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to pass through. This improper neutralization of input during web page generation could enable script execution in user agents that process these schemes. The vulnerability is addressed by updating to Mistune version 3.3.0 where the filter is corrected.

The vulnerability allows injection of unsafe URL schemes into rendered HTML attributes, potentially leading to cross-site scripting attacks that can compromise confidentiality and integrity of user data in affected applications. The CVSS score of 6.1 indicates a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity. There is no indication of availability impact or known exploits in the wild.

Upgrade Mistune to version 3.3.0 or later, where the safe_url filter properly blocks unsafe URL schemes. No other mitigation is indicated or required as the issue is fixed in this official release.