Log in Start free

Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-59924Mistune: Arbitrary File Read via Include directive path traversal

Medium 5.9

In plain English

A medium-severity path traversal in mistune from lepture. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.5%top 59.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mistuneno fix listedDEBIAN-CVE-2026-59924
Debian:13mistuneno fix listedDEBIAN-CVE-2026-59924
Debian:14mistuneno fix listedDEBIAN-CVE-2026-59924
PyPImistune3.3.0GHSA-r4rv-85jg-w4mf
PyPImistune3.3.0PYSEC-2026-2212
Ubuntu:22.04:LTSmistuneno fix listedUBUNTU-CVE-2026-59924
Ubuntu:24.04:LTSmistuneno fix listedUBUNTU-CVE-2026-59924
Ubuntu:25.10mistuneno fix listedUBUNTU-CVE-2026-59924
Ubuntu:26.04:LTSmistuneno fix listedUBUNTU-CVE-2026-59924
Ubuntu:26.10mistuneno fix listedUBUNTU-CVE-2026-59924

Affected products (as reported)

VendorProductVersions
lepture mistune < 3.3.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References