{"id":"CVE-2026-115355","kind":"vulnerability","aliases":["CVE-2026-115355","GHSA-h7ww-273w-6cm8"],"related":[],"title":"Mistune: Path Traversal and XSS in Include directive","description":"The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within the source directory, allowing path traversal via `../` sequences to read arbitrary files.\n\nAdditionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when `escape=True`.\n\nAffected functions:\n- Path resolution (lines 27-31)\n- `block_error()` in html.py (line 140)\n- `render_html_include()` (line 72)\n\nThe Include plugin must be explicitly enabled via the plugins parameter.","summary":"Mistune's Include directive does not check that included file paths stay inside the source directory, so `../` sequences read arbitrary files on the server. Included file contents and error messages are also rendered without HTML escaping, enabling XSS even when escape=True is set.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mistune","fixed":["3.3.0"],"affected":"<= 3.2.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-22","markdown-rendering","mistune","package","pypi","python"],"not_affected_if":["default-config","include-plugin-disabled","version-3.3.0-or-later"],"how_to_check":"Run `pip show mistune` and check whether the version is 3.2.0 or lower.\nSearch the code for `mistune.create_markdown` or `plugins=` that includes `include` or `directive`.","fix":"Upgrade mistune to 3.3.0 or later.\nIf upgrading is not possible, remove the Include plugin from the plugins parameter.","status":"open","published_at":"2026-10-22T19:17:41+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:36+00:00","updated_at":"2026-10-23T21:57:31+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:00:36Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade mistune to 3.3.0 or later.\nIf upgrading is not possible, remove the Include plugin from the plugins parameter.","reach":"internet","impact":"high","summary":"Mistune's Include directive does not check that included file paths stay inside the source directory, so `../` sequences read arbitrary files on the server. Included file contents and error messages are also rendered without HTML escaping, enabling XSS even when escape=True is set.","category":"package","who_cares":["python","pypi","mistune","markdown-rendering"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads arbitrary server files and injects scripts into rendered pages.","analyst_note":"","how_to_check":"Run `pip show mistune` and check whether the version is 3.2.0 or lower.\nSearch the code for `mistune.create_markdown` or `plugins=` that includes `include` or `directive`.\nunknown","needs_analyst":false,"not_affected_if":["default-config","include-plugin-disabled","version-3.3.0-or-later"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000492,"input_tokens":2894,"output_tokens":405,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115355':11A,19A '-2026':10A,18A '-22':22B '-31':126C '140':132C '27':125C '273w':15A '6cm8':16A '72':137C 'addit':101C 'affect':120C 'allow':92C 'also':61B 'arbitrari':49B,99C 'block':127C 'check':36B 'content':56B,107C 'cve':9A,17A 'cwe':21B 'direct':8A,33B,76C 'directori':45B,91C 'enabl':66B,144C 'error':58B,102C,128C 'escap':65B,70B,112C,118C 'even':68B,116C 'explicit':143C 'file':39B,50B,55B,85C,100C,106C 'function':121C 'ghsa':13A 'ghsa-h7ww-273w-6cm8':12A 'h7ww':14A 'html':64B,111C,134C 'html.py':130C 'includ':7A,32B,38B,54B,75C,105C,135C,139C 'insid':42B 'lead':113C 'line':124C,131C,136C 'markdown':24B 'markdown-rend':23B 'messag':59B,103C 'mistun':1A,26B,30B 'mistune':20A 'must':141C 'packag':27B 'paramet':148C 'path':2A,40B,86C,93C,122C 'plugin':140C,147C 'pypi':28B 'python':29B 'read':48B,98C 'render':25B,62B,109C,133C 'resolut':123C 'resolv':84C 'sequenc':47B,96C 'server':53B 'set':73B 'sourc':44B,90C 'src/mistune/directives/include.py':78C 'stay':41B,87C 'travers':3A,94C 'true':71B,119C 'valid':81C 'via':95C,145C 'within':88C 'without':63B,110C 'xss':5A,67B,115C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-h7ww-273w-6cm8","url":"https://github.com/advisories/GHSA-h7ww-273w-6cm8","severity":"high","published_at":"2026-10-23T20:46:47+00:00","modified_at":"2026-10-23T20:46:48+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-115355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115355","severity":null,"published_at":"2026-10-22T19:17:41+00:00","modified_at":"2026-10-22T19:17:41+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}