CVE-2025-59940 mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders
Attackers can manipulate substitution placeholders via unvalidated input, potentially altering rendered content in MkDocs sites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59940?
CVE-2025-59940 is a medium-severity vulnerability in mondeja mkdocs-include-markdown-plugin, published on 29 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.
Weakness: CWE-20
Which versions are affected by CVE-2025-59940?
3 open source packages ship an affected version, including mkdocs-include-markdown-plugin.
| Package | Affected | Fixed in |
|---|---|---|
mkdocs-include-markdown-plugin PyPI | All versions | 7.1.8 |
mkdocs-include-markdown-plugin PyPI | All versions | 7.1.8 |
mkdocs-include-markdown-plugin PyPI | All versions | 7.1.8 |
How do I fix CVE-2025-59940?
Upgrade mkdocs-include-markdown-plugin to 7.1.8 or later.
Is CVE-2025-59940 being exploited?
There is no known exploitation of CVE-2025-59940 in the wild and no public exploit code.
Sources
Also known as GHSA-v39m-5m9j-m9w9, PYSEC-2026-1632.