PatchTheCVECVE-2026-59924: Mistune is a Python Markdown parser with renderers and plugins
CVE-2026-59924 is a medium-severity flaw (CVSS 5.9) affecting mistune. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 60%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-07-08 |
| Last modified | 2026-10-25 |
Last updated 2026-10-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-59924?
mistune: upgrade to 3.3.0. Exact commands for each OS are on this page.
Is CVE-2026-59924 being exploited?
CVE-2026-59924 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-59924 affect?
CVE-2026-59924 affects mistune. Severity is medium (CVSS 5.9). Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing craf
How urgent is CVE-2026-59924?
Priority 41/100. Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-59922 HIGH 7.5 UPGRADE Mistune is a Python Markdown parser with renderers and plugins
- CVE-2026-59925 HIGH 7.5 UPGRADE Mistune is a Python Markdown parser with renderers and plugins
- CVE-2026-59928 HIGH 7.5 UPGRADE Mistune is a Python Markdown parser with renderers and plugins
- CVE-2026-59927 MEDIUM 5.3 UPGRADE Mistune is a Python Markdown parser with renderers and plugins
- CVE-2026-59923 MEDIUM 6.1 UPGRADE Mistune is a Python Markdown parser with renderers and plugins