Live › vulnerability › GHSA-8cqv-vvq2-6p8c
Go to dashboardThis advisory is a withdrawn duplicate of GHSA-h7ww-273w-6cm8 and describes a flaw in the Mistune Python Markdown library before 3.3.0. An attacker who can supply Markdown to an affected Mistune Include directive can read arbitrary files via ../ path sequences and inject HTML/XSS even with escape=True.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mistune | pypi | < 3.3.0 | – |
pip show mistune or pip freeze | grep -i mistune to get the installed version; flag anything below 3.3.0 and check whether any Include directive is enabled on user-supplied Markdown.
Upgrade mistune to 3.3.0 or later; track GHSA-h7ww-273w-6cm8 as the canonical advisory.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references.
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
This page as .md · .json · in your agent: get_signal("GHSA-8cqv-vvq2-6p8c")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.