Mistune CVE-2026-59924

Exploitation requires three concurrent conditions: (1) the target application uses Mistune's Include plugin and calls md.read() on the processed markdown, (2) the markdown content or specifically the include directive within it is controllable by an external or untrusted party, and (3) the process running Mistune has read permissions on the target file outside the markdown base directory. Applications where markdown is strictly authored by trusted operators and never accepted from external users are not exploitable regardless of Mistune version. The CVSS PR:N vector reflects that the Mistune library itself imposes no authentication requirement - the effective authentication boundary is determined entirely by downstream application-level access controls on who may submit markdown content.

The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects high confidentiality impact tempered by high attack complexity, since exploitation requires the Include plugin to be active and user-supplied markdown to reach md.read(). The CVE is not listed in the CISA KEV catalog, no EPSS data was provided, and no POC is referenced in the available intelligence - all signals collectively indicating no confirmed active exploitation at time of analysis. Real-world risk is therefore highly deployment-dependent: applications that allow untrusted users to submit markdown processed by md.read() with the Include plugin are at meaningful risk of arbitrary file disclosure, while applications where markdown is strictly authored by trusted operators face minimal practical risk. The AV:N rating is the worst-case assumption that markdown arrives over the network, which is the common pattern for web applications but not universal across all Mistune deployments.

An attacker submits a markdown document containing a crafted include directive such as referencing ../../etc/passwd to a web application that processes user-supplied markdown with Mistune's Include plugin via md.read(). Include.parse() normalizes the path but does not verify the result remains within the markdown base directory, so the traversal sequence resolves to an arbitrary filesystem location readable by the application process. The contents of the target file are then returned to the attacker through the application's rendered output or error response.