VDB
CVE-2026-59927
CVE-2026-59927
PUBLISHED
CVSS 5.3 MEDIUM
Reported by GitHub_M · Published July 8, 2026
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.
Risk Scores
CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| lepture | mistune | < 3.3.0 |
| PyPI | mistune | 0 |
| lepture | mistune | < 3.3.0, < 3.3.0 |
Timeline
- Jul 8, 2026 CVE Published
- Jul 9, 2026 EPSS Score
- Jul 9, 2026 Coalition ESS Score
- Jul 9, 2026 CVE Updated
- Aug 7, 2026 EPSS Score
- Aug 21, 2026 Security Advisory
References
- https://github.com/lepture/mistune/security/advisories/GHSA-8mpj-m6qm-5qr8 x_refsource_CONFIRM
- https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993 x_refsource_MISC
- https://github.com/lepture/mistune/releases/tag/v3.3.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-59927 advisory
- https://github.com/advisories/GHSA-8mpj-m6qm-5qr8 advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2215.yaml advisory