StackRadar

CVE-2026-59924

Medium

Advisory

Published 8 Jul 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
24
of 17,781 indexed, latest versions
Container images
27
deployed by those charts
Fix available
1 of 1
affected package

Mistune: Arbitrary File Read via Include directive path traversal

Carried by container images the latest versions of 24 of 17,781 indexed charts deploy, on 27 images.

Affected packageAffected versionsFixed inImages
mistunepypi0.8.3, 0.8.4, 2.0.4, 3.0.1+5 more3.3.027
OSV records
GHSA-r4rv-85jg-w4mf
Also known as
PYSEC-2026-2212

Charts affected

24 by stars
ChartLatestAffected imagesRadar Score
daskdask2024.1.11 of 2See more

dask dask 2024.1.1

1 of the 2 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
mistune@3.0.2
3.3.0

Open the chart page →

12,746
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
mistune@0.8.4
3.3.0

Open the chart page →

52,919
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
mistune@3.0.2
3.3.0

Open the chart page →

14,094
tensorflow-notebookcloudnativeapp0.1.21 of 1See more

tensorflow-notebook cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
tensorflow/tensorflow:1.6.0-devel1e3172090703
mistune@0.8.3
3.3.0

Open the chart page →

36,094
deepstackgeek-cookbookVerified publisher1.5.21 of 2See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
robmarkcole/deepstack-ui:latest410275726459
mistune@0.8.4
3.3.0

Open the chart page →

5,305
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
mistune@3.2.0
3.3.0

Open the chart page →

1,678
clowder2ncsaVerified publisher1.9.73 of 12See more

clowder2 ncsa 1.9.7

3 of the 12 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
mistune@3.0.2
3.3.0
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
mistune@3.0.2
3.3.0
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
mistune@3.0.2
3.3.0

Open the chart page →

37,373
duoauthproxy-radius-simplecaerus0.1.01 of 1See more

duoauthproxy-radius-simple caerus 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
ethanbergstrom/duoauthproxy:5.5.0345c2a46c103
mistune@0.8.3
3.3.0

Open the chart page →

2,974
daskcloudnativeapp2.2.11 of 2See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
daskdev/dask-notebook:1.1.0052630f5ca04
mistune@0.8.4
3.3.0

Open the chart page →

29,901
distributed-tensorflowcloudnativeapp0.1.11 of 1See more

distributed-tensorflow cloudnativeapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
cheyang/distributed-tf:1.6.046cc34755493
mistune@0.8.3
3.3.0

Open the chart page →

36,094
galaxycloudve6.8.61 of 3See more

galaxy cloudve 6.8.6

1 of the 3 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
mistune@3.2.1
3.3.0

Open the chart page →

4,601
janisterminalcloudve0.1.01 of 2See more

janisterminal cloudve 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
cloudve/janis-terminal:latestaf56e77ca587
mistune@0.8.4
3.3.0

Open the chart page →

14,270
jupyterhubd4nVerified publisher3.3.71 of 7See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
mistune@3.0.2
3.3.0

Open the chart page →

16,604
amundsenduyet1.1.02 of 7See more

amundsen duyet 1.1.0

2 of the 7 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
amundsendev/amundsen-metadata:2.5.44d98eb21f5f9
mistune@0.8.4
3.3.0
amundsendev/amundsen-search:2.4.099dda9502c3e
mistune@0.8.4
3.3.0

Open the chart page →

11,174
gmaas-github-apigmaas-github-api2.0.11 of 1See more

gmaas-github-api gmaas-github-api 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
gmaas2/github-api:latest148fc2d9afe9
mistune@2.0.4
3.3.0

Open the chart page →

1,205
hawk-envoy-pluginhawk0.1.01 of 4See more

hawk-envoy-plugin hawk 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
kong/httpbin:latesta6ac46531193
mistune@3.1.0
3.3.0

Open the chart page →

9,096
httpbin2022httpbin2022Verified publisher0.1.11 of 1See more

httpbin2022 httpbin2022 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
mshanley80/httpbin2022:latest5b189a70c0fb
mistune@2.0.4
3.3.0

Open the chart page →

8,685
kovi-appkovi-charts0.8.11 of 1See more

kovi-app kovi-charts 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
kennethreitz/httpbin:latest599fe5e50731
mistune@0.8.4
3.3.0

Open the chart page →

14,813
jupyterhubkubeblocksVerified publisher0.1.01 of 7See more

jupyterhub kubeblocks 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
mistune@3.0.1
3.3.0

Open the chart page →

7,356
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
mistune@2.0.4
3.3.0

Open the chart page →

2,765
squash-apilsst-sqre0.1.61 of 3See more

squash-api lsst-sqre 0.1.6

1 of the 3 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
lsstsqre/squash-api:0.5.34879415ec6ac
mistune@0.8.4
3.3.0

Open the chart page →

6,611
falcon-asgi-serverphanVerified publisher0.1.01 of 1See more

falcon-asgi-server phan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
phan2410/falcon-asgi-server:0.1.04a86d138832d
mistune@3.1.3
3.3.0

Open the chart page →

8,189
tezos-nodetezos-nodeVerified publisher1.0.01 of 4See more

tezos-node tezos-node 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
mistune@0.8.4
3.3.0

Open the chart page →

5,321
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-59924.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
mistune@3.2.1
3.3.0

Open the chart page →

7,849

Container images carrying it

27 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
amundsendev/amundsen-metadata:2.5.44d98eb21f5f9
mistune@0.8.4
3.3.0
1
amundsendev/amundsen-search:2.4.099dda9502c3e
mistune@0.8.4
3.3.0
1
aristidetm/basic-notebook:3.6.5469dbc951224
mistune@3.0.2
3.3.0
1
cheyang/distributed-tf:1.6.046cc34755493
mistune@0.8.3
3.3.0
1
cloudve/janis-terminal:latestaf56e77ca587
mistune@0.8.4
3.3.0
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
mistune@3.0.2
3.3.0
1
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
mistune@3.0.2
3.3.0
1
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
mistune@3.0.2
3.3.0
1
daskdev/dask-notebook:1.1.0052630f5ca04
mistune@0.8.4
3.3.0
1
ethanbergstrom/duoauthproxy:5.5.0345c2a46c103
mistune@0.8.3
3.3.0
1
gmaas2/github-api:latest148fc2d9afe9
mistune@2.0.4
3.3.0
1
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
mistune@3.0.1
3.3.0
1
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
mistune@0.8.4
3.3.0
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
mistune@3.2.0
3.3.0
1
kennethreitz/httpbin:latest599fe5e50731
mistune@0.8.4
3.3.0
1
kong/httpbin:latesta6ac46531193
mistune@3.1.0
3.3.0
1
kyso/kyso-nbdime:latest4aa9d38ee81d
mistune@2.0.4
3.3.0
1
lsstsqre/squash-api:0.5.34879415ec6ac
mistune@0.8.4
3.3.0
1
mshanley80/httpbin2022:latest5b189a70c0fb
mistune@2.0.4
3.3.0
1
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
mistune@0.8.4
3.3.0
1
pangeo/base-notebook:2024.01.155fbe688a4f80
mistune@3.0.2
3.3.0
1
phan2410/falcon-asgi-server:0.1.04a86d138832d
mistune@3.1.3
3.3.0
1
robmarkcole/deepstack-ui:latest410275726459
mistune@0.8.4
3.3.0
1
tensorflow/tensorflow:1.6.0-devel1e3172090703
mistune@0.8.3
3.3.0
1
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
mistune@3.2.1
3.3.0
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
mistune@3.0.2
3.3.0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
mistune@3.2.1
3.3.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.