mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00068.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Mkdocs
  • Mkdocs
Mondeja
  • Mkdocs-include-markdown-plugin

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Mkdocs
  • Mkdocs
Mondeja
  • Mkdocs-include-markdown-plugin
Advisories
Source ID Title
EUVD EUVD EUVD-2025-31581 mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.
Github GHSA Github GHSA GHSA-v39m-5m9j-m9w9 mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/mondeja/mkdocs-include-markdown-plugin/commit/7466d67aa0de8ffbc427204ad2475fed07678915 cve-icon cve-icon cve-icon
https://github.com/mondeja/mkdocs-include-markdown-plugin/issues/274 cve-icon cve-icon cve-icon
https://github.com/mondeja/mkdocs-include-markdown-plugin/pull/277 cve-icon cve-icon cve-icon
https://github.com/mondeja/mkdocs-include-markdown-plugin/security/advisories/GHSA-v39m-5m9j-m9w9 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-59940 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-59940 cve-icon
History

Wed, 01 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 30 Sep 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 30 Sep 2025 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Mkdocs
Mkdocs mkdocs
Mondeja
Mondeja mkdocs-include-markdown-plugin
Vendors & Products Mkdocs
Mkdocs mkdocs
Mondeja
Mondeja mkdocs-include-markdown-plugin

Mon, 29 Sep 2025 22:30:00 +0000

Type Values Removed Values Added
Description mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.
Title mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-09-30T14:34:58.817Z

Reserved: 2025-09-23T14:33:49.505Z

Link: CVE-2025-59940

cve-icon Vulnrichment

Updated: 2025-09-30T14:34:55.842Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-29T23:15:31.967

Modified: 2025-10-02T19:12:42.843

Link: CVE-2025-59940

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-09-29T22:27:30Z

Links: CVE-2025-59940 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-09-30T08:47:46Z