Log in Start free

Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-59927Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Medium 5.3

In plain English

A medium-severity security flaw in mistune from lepture. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 55.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mistuneno fix listedDEBIAN-CVE-2026-59927
Debian:13mistuneno fix listedDEBIAN-CVE-2026-59927
Debian:14mistuneno fix listedDEBIAN-CVE-2026-59927
PyPImistune3.3.0GHSA-8mpj-m6qm-5qr8
PyPImistune3.3.0PYSEC-2026-2215
Ubuntu:22.04:LTSmistuneno fix listedUBUNTU-CVE-2026-59927
Ubuntu:24.04:LTSmistuneno fix listedUBUNTU-CVE-2026-59927
Ubuntu:25.10mistuneno fix listedUBUNTU-CVE-2026-59927
Ubuntu:26.04:LTSmistuneno fix listedUBUNTU-CVE-2026-59927
Ubuntu:26.10mistuneno fix listedUBUNTU-CVE-2026-59927

Affected products (as reported)

VendorProductVersions
lepture mistune < 3.3.0

Weakness: CWE-674, CWE-755 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References