Threats tagged 'brew-recon-ng-cve-2026-59923'

CVE-2026-59923 is a cross-site scripting (XSS) vulnerability in the Mistune Markdown rendering library's safe_url() function prior to version 3.3.0. The flaw arises because the function does not decode percent-encoded characters before validating URL schemes, allowing attackers to bypass the javascript: URI filter. This can result in arbitrary JavaScript execution when a user interacts with a crafted Markdown link or image. A patch is available in versions 1.4.0_6 and 5.1.2_4 to address this issue. The vulnerability is rated medium severity with a CVSS score of 6.1.