CVE-2026-59927

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993	Patch
https://github.com/lepture/mistune/releases/tag/v3.3.0	Release Notes
https://github.com/lepture/mistune/security/advisories/GHSA-8mpj-m6qm-5qr8	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Mistune es un analizador de Markdown de Python con renderizadores y complementos. Antes de la versión 3.3.0, la directiva Include en src/mistune/directives/include.py detecta solo auto-inclusiones directas y no ciclos indirectos, permitiendo que dos archivos markdown que se incluyan mutuamente desencadenen una recursión ilimitada, generen un RecursionError y bloqueen la solicitud de renderizado. Este problema está solucionado en la versión 3.3.0.

Information

Published : 2026-07-08 17:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-59927

Mitre link : CVE-2026-59927

CVE.ORG link : CVE-2026-59927

JSON object : View

Products Affected

mistune_project

mistune

CWE

CWE-674

Uncontrolled Recursion

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2026-59927", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59927", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T19:45:06.559977Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lepture", "product": "mistune", "versions": [{"status": "affected", "version": "< 3.3.0"}]}]}], "published": "2026-07-08T17:17:28.450", "references": [{"url": "https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lepture/mistune/releases/tag/v3.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lepture/mistune/security/advisories/GHSA-8mpj-m6qm-5qr8", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-674"}, {"lang": "en", "value": "CWE-755"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0."}, {"lang": "es", "value": "Mistune es un analizador de Markdown de Python con renderizadores y complementos. Antes de la versi\u00f3n 3.3.0, la directiva Include en src/mistune/directives/include.py detecta solo auto-inclusiones directas y no ciclos indirectos, permitiendo que dos archivos markdown que se incluyan mutuamente desencadenen una recursi\u00f3n ilimitada, generen un RecursionError y bloqueen la solicitud de renderizado. Este problema est\u00e1 solucionado en la versi\u00f3n 3.3.0."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63E1B933-D2E2-44EF-A56C-94483300845B", "versionEndExcluding": "3.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}