Mistune, a Python Markdown parser, allows unescaped HTML class values from the :class: option of its Admonition directive to be concatenated directly into rendered HTML. This missing escaping creates a classic input validation flaw (CWE-79) that lets an attacker inject arbitrary HTML attributes, such as JavaScript event handlers, into the page. The malicious script runs in the context of the user’s browser, enabling session hijacking, data theft or defacement when the rendered markdown is displayed. The vulnerability is only exploitable where user‑supplied markdown is rendered and delivered to a browser.

The flaw impacts any application that incorporates the Mistune parser from lepture, version older than 3.2.1, and renders Markdown containing the Admonition directive. If the directive is not disabled or the :class: option is not filtered, user‑supplied content can inject arbitrary HTML attributes. Open‑source projects and other software that depend on Mistune directly or indirectly are potential targets, but only those that use the vulnerable directive in a context that displays the rendered HTML.

The CVSS score of 5.3 places the flaw in the moderate range, but exploitation is straightforward, requiring only crafted markdown. No additional privileges or network access are necessary beyond the ability to supply or influence the markdown content. The EPSS score of <1% indicates a very low probability of exploitation. Based on the description, it is inferred that the attack likely occurs in an HTTP context where the rendered markdown is delivered to a browser, resulting in client‑side code execution. The vulnerability is not listed in the CISA KEV catalogue.