Markdown Parser Vulnerability in Mistune by Lepture

CVE-2026-59927

What is CVE-2026-59927?

Mistune, a popular Python Markdown parser, suffers from a vulnerability where the Include directive only identifies direct self-includes, failing to detect indirect cycles. This oversight allows two Markdown files to include each other, potentially leading to unbounded recursion and causing rendering requests to terminate unexpectedly. This issue has been addressed in version 3.3.0, enhancing the parser's reliability against such recursive errors.

References