mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-cb26113de5 advisory.

    # v7.2.0     ## New features

    - Add new argument `order` to sort multiple inclusions.

    # v7.1.8     ## Bug fixes

    - Escape substitution placeholders to prevent malformed output in edge cases. (CVE-2025-59940)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1b1bb708af advisory.

    # v7.2.0     ## New features

    - Add new argument `order` to sort multiple inclusions.

    # v7.1.8     ## Bug fixes

    - Escape substitution placeholders to prevent malformed output in edge cases. (CVE-2025-59940)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-0ec38c29fa advisory.

    Automatic update for python-mkdocs-include-markdown-plugin-7.2.0-1.fc44.

    ##### **Changelog**

    ```
    * Mon Nov 24 2025 Michel Lind <salimma@fedoraproject.org> - 7.2.0-1
    - Update to 7.2.0
    - Resolves: rhbz#2344045
    - 7.1.8 fixes CVE-2025-59940; Resolves: rhbz#2400521

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there
    is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed
    in version 7.1.8. (CVE-2025-59940)

ID	Name	Product	Family	Severity
276700	Fedora 42 : python-mkdocs-include-markdown-plugin (2025-cb26113de5)	Nessus	Fedora Local Security Checks	medium
276697	Fedora 43 : python-mkdocs-include-markdown-plugin (2025-1b1bb708af)	Nessus	Fedora Local Security Checks	medium
276673	Fedora 44 : python-mkdocs-include-markdown-plugin (2025-0ec38c29fa)	Nessus	Fedora Local Security Checks	medium
435454	SCA: security update for mkdocs-include-markdown-plugin (GHSA-v39m-5m9j-m9w9)	Tenable Cloud Security	SCA Checks	medium
435454	SCA: security update for mkdocs-include-markdown-plugin (GHSA-v39m-5m9j-m9w9)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-59940

medium

Tenable Plugins

medium

medium

medium

medium

medium