Medium severity · published Jul 8, 2026
CVE-2026-59927
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
mistune · lepture
< 3.3.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59927
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59927
Patch
https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993
Release Notes
https://github.com/lepture/mistune/releases/tag/v3.3.0
Exploit
https://github.com/lepture/mistune/security/advisories/GHSA-8mpj-m6qm-5qr8
More from mistune
8.6
CVE-2026-115353
Mistune before 3.3.0 Path Traversal via include Directive
7.5
CVE-2026-115355
Mistune before 3.3.0 Path Traversal and XSS via Include Directive
7.5
CVE-2026-115352
Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
7.5
CVE-2026-115349
Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
7.5
CVE-2026-115348
Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text