Vulnerability Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mistune Project | Mistune | < 3.3.0 |
Related Weaknesses (CWE)
References
- https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb9Patch
- https://github.com/lepture/mistune/releases/tag/v3.3.0Release Notes
- https://github.com/lepture/mistune/security/advisories/GHSA-r4rv-85jg-w4mfExploitVendor Advisory
- https://github.com/lepture/mistune/security/advisories/GHSA-r4rv-85jg-w4mfExploitVendor Advisory
FAQ
What is CVE-2026-59924?
CVE-2026-59924 is a vulnerability with a CVSS score of 5.9 (MEDIUM). Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the in...
How severe is CVE-2026-59924?
CVE-2026-59924 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-59924?
Check the references section above for vendor advisories and patch information. Affected products include: Mistune Project Mistune.