CVE-2026-59927: Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
Vulnerability summary
CVE-2026-59927 is a medium (CVSS 5.3) Uncontrolled Recursion vulnerability in lepture mistune. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.8% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 08-07-2026PublishedVulnerability first disclosed.
- 08-07-2026Last modifiedVulnerability information updated.
Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.53% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundMistune
Maturity: poc
Weaknesses
CWE · root cause- CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
- CWE-755Improper Handling of Exceptional ConditionsThe product does not handle or incorrectly handles an exceptional condition.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- mistuneAll versions (No fix recorded)
Lepture1 product
- mistune< 3.3.0
Mistune_project1 product
- mistune< 3.3.0
PyPI1 product
- mistune< 3.3.0
Ubuntu1 product
- mistuneAll versions (No fix recorded)
5 vendors · 5 products
References
9 links- github.com/lepture/mistune/security/advisories/GHSA-8mpj-m6qm-5qr8X Refsource CONFIRMWEBEVIDENCEREPORTExploitThird Party Advisory
- github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993X Refsource MISCWEBFIXPatch
- github.com/lepture/mistunePACKAGE
