Mistune: XSS via unescaped class option in Admonition directive (CVE-2026-59926) | HOL Guard CVE