Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-08 | 2 | Disclosure1General1 |
| 2026-07-21 | 1 | Disclosure1 |
🟠 Mistune (#Python Markdown Parser) - Path Traversal Vulnerability, #CVE-2026-59924 (Medium) -DC-Jul2026-1111 https://dailycve.com/mistune-python-markdown-parser-path-traversal-vulnerability-cve-2026-59924-medium-dc-jul2026-1111/
Post summary
A Medium‑severity path traversal vulnerability (CVE‑2026‑59924) was disclosed for the Mistune Python Markdown parser.
🚨*CVE* CVE-2026-59924 Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying tha… https://www.cve.org/CVERecord?id=CVE-2026-59924 ----- Traducción: CVE-2026-59924 Mis… http://infoflow.cloud`
Post summary
The text announces CVE-2026-59924, provides a short description of the vulnerable function, and links to the CVE record, but offers no further details, PoC, exploitation claims, or mitigations.
CVE-2026-59924 Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying tha… https://www.cve.org/CVERecord?id=CVE-2026-59924
Post summary
The snippet describes a path‑normalization issue in Mistune prior to version 3.3.0, providing technical details but no evidence of exploitation, PoC, or patch availability.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mistune_project | mistune | - | - | - |