{
  "cveId": "CVE-2026-59927",
  "url": "https://patchblox.com/security/cve/CVE-2026-59927",
  "summary": "CVE-2026-59927 is fixed in python-mistune on 1 platform, first by SUSE-SU-2026:22655-1, released July 14, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python-mistune: This update for python-mistune fixes the following issues\n\n- CVE-2026-59922: quadratic-time parsing on long runs of s...",
  "description": "This update for python-mistune fixes the following issues\n\n- CVE-2026-59922: quadratic-time parsing on long runs of some markers in \u0060formatting.py\u0060 can lead to DoS (bsc#1271117).\n- CVE-2026-59923: \u0060HTMLRenderer.safe_url()\u0060 does not block percent-encoded javascript URIs and allows for XSS\n  (bsc#1271119).\n- CVE-2026-59924: improper processing of user-supplied include paths in \u0060Include.parse()\u0060 can lead to path traversal\n  and arbitrary file reads (bsc#1271121).\n- CVE-2026-59925: quadratic-time parsing on long runs of some emphasis pairs in \u0060inline_parser\u0060 can lead to DoS\n  (bsc#1271125).\n- CVE-2026-59926: improper escaping in \u0060render_admonition()\u0060 can lead to atribute injection and XSS (bsc#1271127).\n- CVE-2026-59927: uncontrolled recursion when processing two markdown files that include each other can lead to a DoS\n   (bsc#1271128).\n- CVE-2026-59928: quadratic-time parsing on long lists of repeated reference-link definitions in \u0060block_parser\u0060 can\n  lead to DoS (bsc#1271131).\n- CVE-2026-59929: HARMFUL_PROTOCOLS list misses legacy and chained schemes and allow arbitrary script execution in\n  user agents (bsc#1271132).\n- CVE-2026-59930: the \u0060toc\u0060 plugin and \u0060TableOfContents\u0060 directive generate heading IDs with predictable values and\n  allow for collisions with attacker-controlled \u0060id=\u0022toc_N\u0022\u0060 content (bsc#1271082).",
  "published": "2026-07-14T10:37:38Z",
  "severity": "",
  "epss": 0.00529,
  "epssPercentile": 0.45022,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-mistune",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.1.3-160000.5.1",
      "fix": "OPENSUSE-SU-2026:21339-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21339-1",
      "released": "2026-07-14T10:41:18Z"
    },
    {
      "platform": "linux",
      "product": "python-mistune",
      "release": "sles 16.0",
      "fixedVersion": "3.1.3-160000.5.1",
      "fix": "SUSE-SU-2026:22655-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22655-1",
      "released": "2026-07-14T10:37:38Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}