What’s Vulnerable › Vulnerabilities

CVE-2026-59924: Mistune: Arbitrary File Read via Include directive path traversal

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-08 · updated 2026-10-25
• Weakness: CWE-22

Description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.

Affected products

• lepture mistune: before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: lepture mistune 3.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993
• https://github.com/lepture/mistune/releases/tag/v3.3.0
• https://github.com/lepture/mistune/security/advisories/GHSA-r4rv-85jg-w4mf
• https://github.com/lepture/mistune/security/advisories/GHSA-r4rv-85jg-w4mf

Get alerted when CVE-2026-59924 or the next vulnerability affects your stack