CVE-2026-59924
Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files…
Does this matter?
Lower severity and a low EPSS score (0.46%). Track it; it rarely justifies an emergency change on its own.
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.46% probability · 39th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- mistune project/mistune
- Source
- security-advisories@github.com
References
- https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993Patch
- https://github.com/lepture/mistune/releases/tag/v3.3.0Release Notes
- https://github.com/lepture/mistune/security/advisories/GHSA-r4rv-85jg-w4mfExploit, Vendor Advisory
- https://github.com/lepture/mistune/security/advisories/GHSA-r4rv-85jg-w4mfExploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.