What’s Vulnerable › Vulnerabilities

CVE-2025-59940: mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-29 · updated 2026-10-09
• Weakness: CWE-20

Description

mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.

Affected products

• mondeja mkdocs-include-markdown-plugin: before 7.1.8

References

• https://github.com/mondeja/mkdocs-include-markdown-plugin/commit/7466d67aa0de8ffbc427204ad2475fed07678915
• https://github.com/mondeja/mkdocs-include-markdown-plugin/issues/274
• https://github.com/mondeja/mkdocs-include-markdown-plugin/pull/277
• https://github.com/mondeja/mkdocs-include-markdown-plugin/security/advisories/GHSA-v39m-5m9j-m9w9

Get alerted when CVE-2025-59940 or the next vulnerability affects your stack