6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59940

CVE-2025-59940: mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders

Impact

CWE-20: Improper Input Validation Low impact

Patches

Patched in v7.1.8 (commit https://github.com/mondeja/mkdocs-include-markdown-plugin/commit/7466d67aa0de8ffbc427204ad2475fed07678915)

Workarounds

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59940

CVE-2025-59940:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mkdocs-include-markdown-plugin	pip	< 7.1.8	7.1.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2025-59940 (GHSA-v39m-5m9j-m9w9), is a CWE-20 (Improper Input Validation) issue in the mkdocs-include-markdown-plugin. The root cause is that the plugin's internal placeholder syntax could collide with user-provided content in markdown files.

The plugin works by replacing {% include-markdown ... %} tags with the content of other files. To do this, it first replaces the tag with a unique placeholder (e.g., \u0002klzzwxh:0\u0003), and after all tags are processed, it substitutes these placeholders with the actual file content. The vulnerability arises because if a user's markdown file already contains a string identical to a placeholder, the plugin would incorrectly replace this string with included content, leading to unexpected output.

The analysis of the patch commit 7466d67aa0de8ffbc427204ad2475fed07678915 reveals the fix. The core changes are in the found_include_markdown_tag function within src/mkdocs_include_markdown_plugin/event.py. Before processing, the entire markdown input is now passed through a new escape_placeholders function, which neutralizes the special characters (\u0002 and \u0003) used to denote placeholders. After all legitimate includes are processed, the unescape_placeholders function is called to restore the original characters.

The vulnerable functions are:

on_page_markdown: The main event handler that receives the untrusted markdown input.
found_include_markdown_tag: The function that performs the unsafe placeholder substitution. During exploitation, a runtime profile would show a call to on_page_markdown, which in turn calls found_include_markdown_tag, where the flawed logic resides.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.