PT-2026-56518 · Pypi · Mistune
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Mistune versions prior to 3.3.0
Description
The Include directive in
src/mistune/directives/include.py only detects direct self-includes and fails to identify indirect cycles. This allows two markdown files that include each other to trigger unbounded recursion, resulting in a RecursionError and crashing the rendering request.Recommendations
Update to version 3.3.0.
Exploit
Fix
DoS
Uncontrolled Recursion
Improper Handling of Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mistune