Mistune’s safe_url filter, before version 3.3.0, blocked only javascript:, vbscript:, file:, and data: schemes but omitted legacy or chained schemes such as feed:, view‑source:, jar:, livescript:, mocha:, ms‑its:, mk:, and res:. These omitted schemes can lead to a javascript: URL when chained, enabling an attacker to embed Markdown that, when rendered, injects JavaScript into a victim’s browser and triggers a cross‑site scripting event, a weakness classified as CWE‑184 and CWE‑79.

All releases of the Mistune Python Markdown parser prior to 3.3.0 are affected, including the 3.2.x series and earlier; any application that renders Markdown content with a vulnerable version—collaborative editors or web services handling user‑supplied Markdown—is at risk.

The CVSS base score of 6.1 indicates moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who can influence the Markdown source rendered by the application, a common scenario for sites accepting user input; by chaining legacy protocols to a javascript: URL, the attacker can cause arbitrary script execution in the victim’s browser.