CVE-2026-59924: Mistune Path Traversal Vulnerability in Include.parse()

Technical summary

CVE-2026-59924 is a path traversal vulnerability (CWE-22) in Mistune's Include.parse() method. The vulnerability arises from insufficient path normalization when joining user-supplied include paths. While the parser performs path joining and normalization operations, it does not verify that the resulting path remains within the intended markdown directory boundary. When markdown files are processed using md.read(), an attacker controlling include directives can traverse parent directories using path manipulation techniques (such as ../ sequences) to access files outside the permitted scope. The vulnerability requires crafted markdown content but does not require authentication or user interaction beyond processing the malicious markdown file.

Business impact

Organizations using Mistune to process untrusted or user-supplied markdown content face information disclosure risks. If markdown files are sourced from external contributors, uploads, or dynamically generated content, an attacker could read sensitive configuration files, source code, API keys, credentials, or other privileged data accessible to the Mistune process. This is particularly concerning for platforms offering markdown rendering-as-a-service, collaborative documentation systems, or any pipeline that combines user markdown input with file system access. The exposure is limited to confidentiality; integrity and availability are not directly impacted.

Affected systems

Mistune versions prior to 3.3.0 are vulnerable. Any application or service using an affected version to parse or render markdown files—particularly those that support markdown include directives—is at risk if the markdown source is not fully trusted. This includes static site generators, documentation platforms, content management systems, and custom applications built on Mistune. The vulnerability is most severe in multi-tenant or user-content scenarios where markdown input originates from untrusted sources.

Exploitability

Exploitation requires the ability to craft or influence markdown content that will be processed by Mistune. The attack complexity is rated as high because the attacker must understand the target system's directory structure and the specific include syntax supported by Mistune. However, once a malicious markdown file is in place—whether through upload, contribution, or injection—exploitation is straightforward and does not require network access to the application itself or special privileges. The CVSS vector AV:N reflects that a remotely-supplied markdown file can trigger the issue; AC:H indicates the attacker must craft the payload carefully.

Remediation

Upgrade Mistune to version 3.3.0 or later. This version includes fixes to Include.parse() that properly validate include paths and ensure they remain within the intended markdown directory. Before upgrading, audit systems to determine which applications depend on Mistune and verify version numbers in your dependency manifests (requirements.txt, setup.py, poetry.lock, etc.). Consider implementing additional controls: restrict markdown include functionality if not required, validate or sanitize markdown sources before processing, and run markdown processing in sandboxed environments with minimal file system access if handling untrusted input.

Patch guidance

Apply the upgrade to Mistune 3.3.0 or later across all affected environments. For Python projects, update the dependency in your package manager: pip install --upgrade mistune>=3.3.0, then rebuild and redeploy affected applications. Verify the upgrade by checking the installed version and reviewing release notes. If you maintain internal forks or custom Mistune builds, backport the path normalization fixes from the upstream 3.3.0 release or apply equivalent mitigations. Test markdown rendering after the upgrade to ensure functionality is preserved.

Detection guidance

Search for Mistune import statements and version specifications in your codebase and CI/CD configuration. Use dependency scanning tools to identify installed versions of mistune across your infrastructure. Monitor for unusual file access patterns by processes running markdown parsers—specifically lookups targeting parent directories or paths outside the markdown storage location. If you maintain logs of markdown processing, search for include directives containing path traversal sequences (../, ..\ or similar patterns). Review access logs for the process user running Mistune to detect reads of unexpected file paths.

Why prioritize this

Despite a MEDIUM CVSS score, this vulnerability warrants prompt attention because it enables confidentiality compromise in environments handling user-supplied markdown. The threat is heightened if your organization operates multi-tenant platforms, accepts user contributions to documentation, or processes markdown from external sources. However, the attack requires crafted input and does not facilitate remote code execution, system compromise, or lateral movement, which mitigates urgency compared to critical vulnerabilities. Prioritize patching if Mistune processes untrusted markdown; defer if Mistune only renders internal, controlled markdown content.

Risk score, explained

The CVSS:3.1 score of 5.9 (MEDIUM) reflects a confidentiality-only impact (high confidentiality, no integrity or availability loss) that can be triggered remotely (AV:N) but requires careful attack crafting (AC:H). The attack does not require authentication or user interaction beyond markdown processing, and the scope is unchanged. The rating appropriately captures that this is a serious information disclosure vector without being critical; it is more severe than low-impact bugs but less urgent than exploitable RCE or authentication bypasses.

Frequently asked questions