Live › vulnerability › CVE-2026-115350
Go to dashboardMistune, a Python Markdown parser, versions before 3.3.0 pass the content of included .html, .xhtml or .htm files through as raw HTML without escaping. An attacker who can place such a file where the renderer can read it, and reach it through path traversal in an include directive, can get scripts to run in a visitor's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use mistune below 3.3.0 to render Markdown that includes the Include directive, with escape set to False, and where users or attackers can influence which files get included. Applications that keep escaping on or never use the Include directive are not exposed to this flaw.
No product ranges from the sources yet.
pip show mistune or python -c "import mistune; print(mistune.__version__)"escape=False in the renderer configuration3.3.0 or laterescape=True or do not use the Include directive on untrusted pathsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path traversal, to execute stored scripts when escape=False is set.
This page as .md · .json · in your agent: get_signal("CVE-2026-115350")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.