Live › vulnerability › CVE-2026-115355
Go to dashboardMistune's Include directive does not check that included file paths stay inside the source directory, so `../` sequences read arbitrary files on the server. Included file contents and error messages are also rendered without HTML escaping, enabling XSS even when escape=True is set.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC, 1h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| mistune | pypi | <= 3.2.0 | 3.3.0 |
Run pip show mistune and check whether the version is 3.2.0 or lower.
Search the code for mistune.create_markdown or plugins= that includes include or directive.
3.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files.
Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when escape=True.
Affected functions:
block_error() in html.py (line 140)render_html_include() (line 72)The Include plugin must be explicitly enabled via the plugins parameter.
This page as .md · .json · in your agent: get_signal("CVE-2026-115355")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.