Is CVE-2026-59927 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59927 being exploited in the wild.

How severe is CVE-2026-59927?

Medium severity, with a CVSS score of 5.3, published 8 July 2026.

Which products and versions are affected?

mistune (PyPI) < 3.3.0, ECOSYSTEM:introduced=0,fixed=3.3.0.

Is there a fix for CVE-2026-59927?

Yes. mistune (PyPI): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59927 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59927?

Check whether you run mistune (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59927: lepture Mistune uncontrolled recursion in Include directive

Q: Which products and versions are affected?

mistune (PyPI) < 3.3.0, ECOSYSTEM:introduced=0,fixed=3.3.0.

Q: Is there a fix for CVE-2026-59927?

Yes. mistune (PyPI): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59927 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-59927?

Check whether you run mistune (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59927 · Severity: medium · CVSS 5.3 · Published 2026-07-08

Mistune is a Python library used to convert Markdown text into HTML. A vulnerability in its 'include' feature allows an attacker to provide specially crafted files that reference each other in a loop. When the library tries to process these files, it enters an infinite loop that crashes the application, leading to a denial of service.

Technologies: mistune (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-59927 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59927 being exploited in the wild.
How severe is CVE-2026-59927?: Medium severity, with a CVSS score of 5.3, published 8 July 2026.
Which products and versions are affected?: mistune (PyPI) < 3.3.0, ECOSYSTEM:introduced=0,fixed=3.3.0.
Is there a fix for CVE-2026-59927?: Yes. mistune (PyPI): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59927 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59927?: Check whether you run mistune (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mistune (PyPI): upgrade to 3.3.0 or later
```
pip install "mistune>=3.3.0"
```

Technical details

The 'Include' directive in Mistune's RSTDirective plugin fails to properly detect transitive inclusion cycles. While it prevents a file from including itself directly, it does not track the stack of included files during recursive parsing. An attacker with the ability to provide Markdown files (e.g., in a CMS or documentation platform) can create a cycle where 'a.md' includes 'b.md' and 'b.md' includes 'a.md'. This causes the Python interpreter to exceed its maximum recursion depth, raising a 'RecursionError' that propagates and crashes the calling process. The vulnerability is fixed in version 3.3.0 by implementing an include stack to track and reject cyclic references.

Affected products

lepture mistune < 3.3.0

Identifiers

CVE-2026-59927
GHSA-8mpj-m6qm-5qr8
PYSEC-2026-2215

Timeline

2026-06-21: disclosed
2026-07-20: advisory
2026-07-20: patched: Fixed in version 3.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.