CVE-2026-59924: Mistune: Arbitrary File Read via Include directive path traversal
A path traversal issue exists in mistune’s Include directive when markdown files are processed using md.read(). A crafted include path can cause files outside the intended markdown directory to be accessed.
References
- github.com/advisories/GHSA-r4rv-85jg-w4mf
- github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993
- github.com/lepture/mistune/releases/tag/v3.3.0
- github.com/lepture/mistune/security/advisories/GHSA-r4rv-85jg-w4mf
- github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2212.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-59924
Code Behaviors & Features
Detect and mitigate CVE-2026-59924 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →