CVE-2026-59927 | Mistune is a Python Markdown parser with renderers and plugi… | CVSS 5.3 MEDIUM

Description

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.

Metadata

CVE ID: CVE-2026-59927
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-07-07 18:20 UTC
Published: 2026-07-08 16:24 UTC
Last updated: 2026-07-08 19:45 UTC
Primary CWE: CWE-674
CWE-674: Uncontrolled Recursion
Vendor / Product: lepture / mistune
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
lepture	mistune	—	< 3.3.0

Weakness (CWE)

CWE	Source	Description
CWE-674	cna	CWE-674: Uncontrolled Recursion
CWE-755	cna	CWE-755: Improper Handling of Exceptional Conditions

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References (3)

https://github.com/lepture/mistune/security/advisories/GHSA-8mpj-m6qm-5qr8 https://github.com/lepture/mistune/security/advisories/GHSA-8mpj-m6qm-5qr8
https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993 https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993
https://github.com/lepture/mistune/releases/tag/v3.3.0 https://github.com/lepture/mistune/releases/tag/v3.3.0