cbcvebase.
CVE-2026-59927
published 2026-07-08

CVE-2026-59927: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct…

PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.31%
22.7th percentile
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
lepturemistune< 3.3.03.3.0
mistune_projectmistune< 3.3.03.3.0
mtamta-solution-server-rhel9——
rhoaiodh-pipeline-runtime-datascience-cpu-py312-rhel9——
rhoaiodh-pipeline-runtime-minimal-cpu-py312-rhel9——
rhoaiodh-pipeline-runtime-pytorch-cuda-py312-rhel9——
rhoaiodh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9——
rhoaiodh-pipeline-runtime-pytorch-rocm-py312-rhel9——
rhoaiodh-pipeline-runtime-tensorflow-cuda-py312-rhel9——
rhoaiodh-pipeline-runtime-tensorflow-rocm-py312-rhel9——
rhoaiodh-th06-cpu-torch210-py312-rhel9——
rhoaiodh-th06-cpu-torch291-py312-rhel9——
rhoaiodh-th06-cuda130-torch210-py312-rhel9——
rhoaiodh-th06-cuda130-torch291-py312-rhel9——
rhoaiodh-th06-rocm64-torch291-py312-rhel9——
rhoaiodh-workbench-jupyter-datascience-cpu-py312-rhel9——
rhoaiodh-workbench-jupyter-minimal-cpu-py312-rhel9——
rhoaiodh-workbench-jupyter-minimal-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-minimal-rocm-py312-rhel9——
rhoaiodh-workbench-jupyter-pytorch-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-pytorch-rocm-py312-rhel9——
rhoaiodh-workbench-jupyter-tensorflow-cuda-py312-rhel9——
rhoaiodh-workbench-jupyter-tensorflow-rocm-py312-rhel9——
rhoaiodh-workbench-jupyter-trustyai-cpu-py312-rhel9——

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.