GHSA-8cqv-vvq2-6p8cHigh· 7.5▾ TwilightDuplicate Advisory: Mistune: Path Traversal and XSS in Include directive
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references.
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
mistune < 3.3.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115355High· 7.5Mistune: Path Traversal and XSS in Include directive
CVE-2026-115353High· 8.6Mistune before 3.3.0 Path Traversal via include Directive
CVE-2026-44896Medium· 6.1Mistune has XSS via unescaped figclass/figwidth in Figure directive
CVE-2026-76098High· 7.5Mistune is a Python Markdown parser with renderers and plugins
CVE-2026-59930Medium· 4.3Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate hea…
CVE-2026-59929Medium· 6.1Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py bloc…