{"id":"CVE-2026-115350","kind":"vulnerability","aliases":["CVE-2026-115350"],"related":[],"title":"Mistune: Include directive emits raw HTML files, enabling cross-site scripting","description":"Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path traversal, to execute stored scripts when escape=False is set.","summary":"Mistune, a Python Markdown parser, versions before 3.3.0 pass the content of included .html, .xhtml or .htm files through as raw HTML without escaping. An attacker who can place such a file where the renderer can read it, and reach it through path traversal in an include directive, can get scripts to run in a visitor's browser.","severity":"medium","cvss":6.1,"epss":0.00188,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["markdown","mistune","package","python"],"not_affected_if":["escape-enabled","no-include-directive","version-3.3.0-or-later"],"how_to_check":"- Check the installed Mistune version with `pip show mistune` or `python -c \"import mistune; print(mistune.__version__)\"`\n- Look for the Include directive in use and for `escape=False` in the renderer configuration","fix":"- Upgrade mistune to `3.3.0` or later\n- Until upgraded, keep `escape=True` or do not use the Include directive on untrusted paths","status":"open","published_at":"2026-10-22T19:17:40+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:02:10+00:00","updated_at":"2026-10-25T04:02:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:02:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade mistune to `3.3.0` or later\n- Until upgraded, keep `escape=True` or do not use the Include directive on untrusted paths","reach":"internet","title":"Mistune: Include directive emits raw HTML files, enabling cross-site scripting","impact":"medium","summary":"Mistune, a Python Markdown parser, versions before 3.3.0 pass the content of included .html, .xhtml or .htm files through as raw HTML without escaping. An attacker who can place such a file where the renderer can read it, and reach it through path traversal in an include directive, can get scripts to run in a visitor's browser.","category":"package","nicknames":[],"who_cares":["python","mistune","markdown"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker-controlled scripts run in other users' browsers on the site","analyst_note":"","how_to_check":"- Check the installed Mistune version with `pip show mistune` or `python -c \"import mistune; print(mistune.__version__)\"`\n- Look for the Include directive in use and for `escape=False` in the renderer configuration","needs_analyst":false,"not_affected_if":["escape-enabled","no-include-directive","version-3.3.0-or-later"],"who_is_affected":"Applications that use mistune below 3.3.0 to render Markdown that includes the Include directive, with escape set to False, and where users or attackers can influence which files get included. Applications that keep escaping on or never use the Include directive are not exposed to this flaw.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000618,"input_tokens":3374,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115350':15A,18A '-2026':14A,17A '3.3.0':30B,83C 'attack':48B,109C 'block':106C 'browser':80B 'combin':127C 'contain':84C 'content':33B,103C 'cross':10A,87C 'cross-sit':9A,86C 'cve':13A,16A 'direct':3A,70B,94C,126C 'emit':4A,96C 'enabl':8A 'escap':46B,136C 'execut':132C 'fals':137C 'file':7A,40B,54B,102C,115C 'get':72B 'htm':39B,101C 'html':6A,36B,44B,98C,107C,114C 'includ':2A,35B,69B,93C,97C,125C 'markdown':19B,26B 'mistun':1A,20B,23B,81C 'packag':21B 'parser':27B 'pass':31B 'path':65B,129C 'place':51B 'plant':112C 'python':22B,25B 'raw':5A,43B,105C 'reach':62B 'read':59B 'readabl':116C 'refer':121C 'render':57B,119C 'run':75B 'script':12A,73B,89C,134C 'set':139C 'site':11A,88C 'store':133C 'token':108C 'travers':66B,130C 'version':28B 'via':123C 'visitor':78B 'vulner':90C 'without':45B 'xhtml':37B,99C","nicknames":[],"mitigations":[],"who_affected":"Applications that use mistune below 3.3.0 to render Markdown that includes the Include directive, with escape set to False, and where users or attackers can influence which files get included. Applications that keep escaping on or never use the Include directive are not exposed to this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115350","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115350","severity":null,"published_at":"2026-10-22T19:17:40+00:00","modified_at":"2026-10-22T19:17:40+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115350","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115350","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}