Every CVE Search/ Get API key

CVE-2026-115355

Mistune before 3.3.0 Path Traversal and XSS via Include Directive

8.7 HighFix available

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.46%Up 0.1 points since Oct 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

Mistune before 3.3.0 Path Traversal and XSS via Include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Record
CVE-2026-115355
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-108425 8.7

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Record
EUVD-2026-108425
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-8cqv-vvq2-6p8c 8.7

Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references.

Original Description

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Record
GHSA-8cqv-vvq2-6p8c
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
GitHub AdvisoriesGHSA-h7ww-273w-6cm8 No score

Mistune: Path Traversal and XSS in Include directive

The Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files.

Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when escape=True.

Affected functions:

  • Path resolution (lines 27-31)
  • block_error() in html.py (line 140)
  • render_html_include() (line 72)

The Include plugin must be explicitly enabled via the plugins parameter.

Record
GHSA-h7ww-273w-6cm8
Weakness
CWE-22
Updated
2026-11-02
NVD 8.7

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Record
CVE-2026-115355
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 8.7

Mistune before 3.3.0 Path Traversal and XSS via Include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Record
CVE-2026-115355
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2026-115355 8.7

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Record
DEBIAN-CVE-2026-115355
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVGHSA-8cqv-vvq2-6p8c 8.7

Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references.

Original Description

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Record
GHSA-8cqv-vvq2-6p8c
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVUBUNTU-CVE-2026-115355 8.7

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Record
UBUNTU-CVE-2026-115355
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-h7ww-273w-6cm8 No score

Mistune: Path Traversal and XSS in Include directive

The Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files.

Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when escape=True.

Affected functions:

  • Path resolution (lines 27-31)
  • block_error() in html.py (line 140)
  • render_html_include() (line 72)

The Include plugin must be explicitly enabled via the plugins parameter.

Record
GHSA-h7ww-273w-6cm8
Weakness
CWE-22
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mistune
PyPI
 through 3.2.0
3.3.0
mistune
Debian:12
 All versions, plus listed versions
2.0.4-12.0.4-23.0.2-13.0.2-23.1.3-13.1.4-13.3.4-13.4.0-1
 None known
mistune
Debian:13
 All versions, plus listed versions
3.1.3-13.1.4-13.3.4-13.4.0-1
 None known
mistune
Debian:14
 All versions, plus listed versions
3.1.3-13.1.4-13.3.4-13.4.0-1
 None known
mistune
PyPI
 before 3.3.0, plus listed versions
0.1.00.2.00.3.00.3.10.4
Show 45 moreShow less
0.4.10.50.5.10.60.70.7.10.7.20.7.30.7.40.80.8.10.8.20.8.30.8.42.0.02.0.0a12.0.0a22.0.0a32.0.0a42.0.0a52.0.0a62.0.0rc12.0.12.0.22.0.32.0.42.0.52.1.03.0.03.0.0a13.0.0a23.0.0a33.0.0rc13.0.0rc23.0.0rc33.0.0rc43.0.0rc53.0.13.0.23.1.03.1.13.1.23.1.33.1.43.2.0
3.3.0
mistune
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.6-20.7.1-1
 None known
mistune
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.7.4-10.8-10.8.1-10.8.3-2
 None known
mistune
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.8.4-10.8.4-2
 None known
mistune
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.8.4-40.8.4-52.0.0-1+really0.8.4-1
 None known
mistune
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.0.4-23.0.2-1
 None known
mistune
Ubuntu:26.10
 All versions, plus listed versions
3.1.4-1
 None known
mistune
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.3-13.1.4-1
 None known

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-115355 is a high vulnerability (CVSS 8.7) in Lepture Mistune, published October 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in mistune 3.3.0.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 1 version. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open