Mistune’s safe_url filter, before version 3.3.0, blocked only javascript:, vbscript:, file:, and data: schemes but omitted legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms‑its:, mk:, and res:. These omitted schemes can lead to a javascript: URL when chained, enabling an attacker to embed Markdown that, when rendered, injects JavaScript into a victim’s browser and triggers a cross‑site scripting event, a weakness classified as CWE‑184 and CWE‑79.

All releases of the Mistune Python Markdown parser prior to 3.3.0 are affected, including the 3.2.x series and earlier; any application that renders Markdown content with a vulnerable version—collaborative editors or web services handling user‑supplied Markdown—is at risk.

The CVSS base score of 6.1 indicates moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires an attacker who can influence the Markdown source rendered by the application, which is common for sites accepting user input; by chaining legacy protocols to a javascript: URL, the attacker can cause arbitrary script execution in the victim’s browser.