CVE-2025-59940
mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders
mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders
mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.
- Record
CVE-2025-59940- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2025-31581
mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.
- Record
EUVD-2025-31581- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v39m-5m9j-m9w9
mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders
Impact
CWE-20: Improper Input Validation Low impact
Patches
Patched in v7.1.8 (commit https://github.com/mondeja/mkdocs-include-markdown-plugin/commit/7466d67aa0de8ffbc427204ad2475fed07678915)
Workarounds
No
- Record
GHSA-v39m-5m9j-m9w9- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.
- Record
CVE-2025-59940- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders
mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.
- Record
CVE-2025-59940- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-v39m-5m9j-m9w9
mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders
Impact
CWE-20: Improper Input Validation Low impact
Patches
Patched in v7.1.8 (commit https://github.com/mondeja/mkdocs-include-markdown-plugin/commit/7466d67aa0de8ffbc427204ad2475fed07678915)
Workarounds
No
- Record
GHSA-v39m-5m9j-m9w9- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2026-1632
mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders
Impact
CWE-20: Improper Input Validation Low impact
Patches
Patched in v7.1.8 (commit https://github.com/mondeja/mkdocs-include-markdown-plugin/commit/7466d67aa0de8ffbc427204ad2475fed07678915)
Workarounds
No
- Record
PYSEC-2026-1632- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mkdocs-include-markdown-pluginPyPI | before 7.1.8 | 7.1.8 |
mkdocs-include-markdown-pluginPyPI | before 7.1.8, plus listed versions 0.0.10.0.20.1.01.0.02.0.0 Show 45 moreShow less2.1.02.1.12.1.22.2.02.3.02.4.02.5.02.6.02.6.12.7.02.7.12.7.22.8.03.0.03.0.13.1.03.1.13.1.33.1.43.2.03.2.13.2.23.2.33.3.03.4.03.4.13.5.03.5.13.5.23.6.03.6.13.7.03.7.13.8.03.8.13.9.03.9.14.0.04.0.14.0.24.0.34.0.45.0.05.1.06.0.0 | 7.1.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-59940 is a medium vulnerability (CVSS 6.5) in Mondeja Mkdocs-include-markdown-plugin, published September 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in mkdocs-include-markdown-plugin 7.1.8.
References
github.com/mondeja/mkdocs-include-markdown-plugin/security/advisories/GHSA-v39m-5m9j-m9w9
nvd.nist.gov/vuln/detail/CVE-2025-59940
pypi.org/project/mkdocs-include-markdown-plugin
Left out here: 21 versions. The JSON record has them.