VDB
CVE-2026-59924
CVE-2026-59924
PUBLISHED
CVSS 5.9 MEDIUM
Reported by GitHub_M · Published July 8, 2026
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.
Risk Scores
CVSS 3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| lepture | mistune | < 3.3.0 |
| lepture | mistune | < 3.3.0 |
Timeline
- Jul 8, 2026 CVE Published
- Jul 8, 2026 CVE Updated
- Jul 9, 2026 EPSS Score
- Jul 9, 2026 Coalition ESS Score
- Aug 7, 2026 EPSS Score
References
- https://github.com/lepture/mistune/security/advisories/GHSA-r4rv-85jg-w4mf x_refsource_CONFIRM
- https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993 x_refsource_MISC
- https://github.com/lepture/mistune/releases/tag/v3.3.0 x_refsource_MISC