Threats tagged 'brew-jupyterlab-cve-2026-59927'

CVE-2026-59927 is a vulnerability in the mistune Markdown renderer's Include directive that allows uncontrolled recursion via mutual includes of markdown files. The directive only detects direct self-inclusion but fails to detect indirect cycles where two or more files include each other. This leads to unbounded recursion until Python's recursion limit is exceeded, causing a RecursionError that crashes the rendering process. This can be exploited by an attacker who can upload or control markdown files to cause denial of service by crashing the renderer. The issue affects mistune versions used in jupyterlab from 1.2.0 up to but not including 4.6.1. A fix is available in version 4.6.1 that adds cycle detection to prevent infinite recursion.