Older Mistune releases generate predictable heading identifiers using the form toc_N when rendering a TableOfContents. These identifiers are not derived from the heading text, so an attacker can embed an element with an id attribute such as id="toc_N" in the markdown. The generated anchor will then conflict with the attacker‑controlled element, causing links, CSS selectors, or JavaScript targeting #toc_N to resolve to the wrong destination. This client‑side manipulation can redirect users within the page, change the layout, or compromise JavaScript behavior, but it does not provide direct code execution or data exfiltration.

Python applications that include Mistune version 3.2.x or earlier are affected. The issue is fixed in release 3.3.0. All deployments that render untrusted markdown with these older versions are at risk. The vendor is Lepture, the Mistune project.

The CVSS score of 4.3 indicates low severity. EPSS is below 1% and the vulnerability is not listed in CISA KEV, suggesting limited exploitation. The likely attack vector is the injection of malicious markdown into a service that renders it with Mistune—such as content‑management systems, forums, or chat applications. Because the attack requires control over the input, the risk is confined to contexts where untrusted data is parsed. Mitigating by upgrading to 3.3.0 eliminates the flaw immediately.