PT-2026-56517 · Pypi · Mistune

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-59924

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0

Description Mistune is a Python Markdown parser with renderers and plugins. The Include.parse() function joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory. This allows crafted include paths to access files outside that directory when markdown files are processed using md.read().

Recommendations Update to version 3.3.0.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-59924

Affected Products

Mistune

References · 6

• 🔥 https://github.com/lepture/mistune/security/advisories/GHSA-r4rv-85jg-w4mf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-59924 · Security Note
• https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993 · Note
• https://github.com/lepture/mistune/releases/tag/v3.3.0 · Note
• https://twitter.com/CVEnew/status/2074931622957166877 · Twitter Post
• https://twitter.com/infoflowcloud/status/2074933039637880961 · Twitter Post