Recon ng: Mistune TOC Anchor Injection XSS (CVE-2026-44898)

The vulnerability exists in the render_toc_ul() function in Mistune's toc.py, where the function builds a table-of-contents unordered list by formatting heading IDs and text directly into anchor tags without escaping. Specifically, the heading ID (used as href fragment) and the visible link text are inserted via Python string formatting without HTML escaping. If the heading ID is derived from user input (e.g., using a slug-based heading_id callback), an attacker can craft a heading that breaks out of the href attribute and injects malicious HTML and JavaScript, resulting in a stored XSS vulnerability in the rendered TOC. This vulnerability is related to another unescaped heading ID issue (H2). The vulnerability affects recon-ng versions >=5.1.1_1 and <5.1.2_4. The CVSS 3.1 score is 6.1 (Medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

An attacker can inject arbitrary HTML and JavaScript into the table of contents rendered by recon-ng's documentation or markdown output, leading to cross-site scripting (XSS). This can allow execution of malicious scripts in the context of users viewing the affected TOC, potentially leading to session theft or other client-side attacks. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and can be exploited remotely without privileges.

A patch is available for recon-ng versions >=5.1.1_1 and <5.1.2_4 that properly escapes heading IDs and text before inserting them into HTML anchor tags. Users should upgrade to version 5.1.2_4 or later to remediate this vulnerability. Until patched, avoid using untrusted input for heading IDs or disable custom heading_id callbacks that return raw user input. No other vendor advisory states that no action is required.