CVE-2026-59924: Mistune Path Traversal Vulnerability

CVE-2026-59924 Overview

CVE-2026-59924 is a path traversal vulnerability [CWE-22] in Mistune, a widely used Python Markdown parser with support for renderers and plugins. The flaw exists in the Include.parse() function, which joins and normalizes user-supplied include paths without verifying that the resolved path remains within the intended markdown directory. When markdown files are processed through md.read(), a crafted include directive can reference files outside the designated content directory. The issue affects all versions prior to 3.3.0 and is fixed in Mistune 3.3.0.

Critical Impact
Attackers who can supply markdown content to an application using Mistune's include directive can read arbitrary files accessible to the parsing process, exposing configuration files, source code, and secrets.

Affected Products

Mistune Python Markdown parser versions prior to 3.3.0
Applications embedding Mistune with the include directive enabled
Downstream Python packages depending on vulnerable Mistune releases

Discovery Timeline

2026-07-08 - CVE-2026-59924 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59924

Vulnerability Analysis

Mistune provides a directive plugin system that allows markdown authors to include external files through include directives. The Include.parse() method in src/mistune/directives/include.py accepts a user-controlled path argument and passes it through os.path.join and normalization routines. The parser does not confirm that the final resolved path stays within the intended base directory. As a result, sequences such as ../ traverse upward through the filesystem hierarchy. Any file the parsing process has permission to read becomes reachable through a crafted include statement.

Root Cause

The root cause is missing containment validation after path normalization. The pre-patch implementation trusts that os.path.join combined with the base directory yields a safe result. Because os.path.join discards the base when the joined component is absolute, and because normalization resolves .. segments without a boundary check, the resulting file path can escape the markdown directory. The fix in commit 1bef343ade163fc3bb95572b15be720084cdb993 introduces path constraint enforcement so include targets must remain inside the configured directory.

Attack Vector

Exploitation requires the ability to supply markdown content that is later processed by md.read() in an application using the vulnerable Mistune release. An attacker submits markdown containing an include directive whose target is a relative or absolute path outside the markdown directory, such as ../../etc/passwd or an application configuration file. The rendered output leaks the file contents to whichever channel displays the parsed markdown. Confidentiality is impacted; integrity and availability are not.

python

 import os
 from typing import TYPE_CHECKING, Any, Dict, List, Match, Union
 
+from ..util import escape as escape_text
 from ._base import BaseDirective, DirectivePlugin
 
 if TYPE_CHECKING:

Source: GitHub Commit 1bef343. The patch constrains include targets so paths that resolve outside the markdown directory are rejected before file reads occur.

Detection Methods for CVE-2026-59924

Indicators of Compromise

Markdown files containing include directives with ../ traversal sequences or absolute paths pointing outside the content directory.
Application logs showing md.read() invocations followed by reads of sensitive files such as /etc/passwd, .env, or private keys.
Rendered output that contains file contents unrelated to the intended markdown document.

Detection Strategies

Perform static scanning of user-submitted markdown for include directives referencing paths that resolve outside the whitelisted content root.
Instrument the Python runtime to log open() calls originating from the Mistune directives module and alert on paths outside the expected base directory.
Review dependency manifests (requirements.txt, pyproject.toml, Pipfile.lock) for mistune<3.3.0 and flag vulnerable versions during CI builds.

Monitoring Recommendations

Enable file access auditing on the process running the markdown parser and alert on reads outside the designated directory.
Monitor outbound rendered content for markers of leaked system files such as root:x: or key headers like -----BEGIN.
Track exceptions and rendering errors from Mistune to identify probing attempts using malformed include paths.

How to Mitigate CVE-2026-59924

Immediate Actions Required

Upgrade Mistune to version 3.3.0 or later in all environments that process untrusted markdown.
Audit application code paths that call md.read() and identify sources of untrusted markdown input.
Rotate any credentials or secrets that may have been exposed through prior include directive abuse.

Patch Information

The fix is released in Mistune 3.3.0. See the GitHub Release for v3.3.0, the GitHub Security Advisory GHSA-r4rv-85jg-w4mf, and the remediation commit 1bef343 for details. Update the dependency using pip install --upgrade mistune>=3.3.0.

Workarounds

Disable the include directive plugin in applications that do not require it by configuring Mistune without Include in the directives list.
Run the markdown parser under a restricted user account with filesystem access limited to the markdown content directory.
Validate and canonicalize user-supplied include paths before invoking md.read(), rejecting any path that resolves outside the intended base directory.

bash

# Upgrade Mistune to a fixed release
pip install --upgrade 'mistune>=3.3.0'

# Verify installed version
python -c "import mistune; print(mistune.__version__)"