CVE-2026-59924

mediumCVSS 5.9covered by 1 sourcefirst seen 2026-07-08

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.

⚡ Watch CVE-2026-59924

Get an email if CVE-2026-59924 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-59924: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse(…nvd · 2026-07-08

External references

NVD record for CVE-2026-59924

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-59924 status](https://www.csirts.com/badge/CVE-2026-59924)](https://www.csirts.com/cve/CVE-2026-59924)