The vulnerability is a missed HTML escaping in Mistune’s render_toc_ul() function, representing a CWE‑79 flaw. The function incorporates heading id and text into <a> tags using a plain format string. If a heading’s text contains special characters, the attacker can break out of the href attribute and inject arbitrary HTML, including <script> tags, into the rendered table‑of‑contents. This leads to client‑side script execution in any browser rendering the output, enabling XSS attacks against users who view the affected page.

The defect affects all installations of the Mistune Markdown parser preceding version 3.2.1, which is distributed under the lepture:mistune code repository. Applications that employ this library to build tables of contents from user‑supplied Markdown are vulnerable unless they have been upgraded to 3.2.1 or later.

The issue carries a CVSS score of 6.1, indicating a moderate severity. EPSS is not available, so the exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is the provision of crafted Markdown content—an attacker can supply a malicious heading to any component that renders Markdown with a table of contents. As the flaw is a client‑side XSS, successful exploitation requires user interaction with the rendered page.