---
id: GHSA-8cqv-vvq2-6p8c
title: 'Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive'
summary: 'Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive'
severity: high
cvss: 7.5
cwe:
  - CWE-22
vendor: mistune
product: mistune
ecosystem: pip
affected:
  - mistune < 3.3.0
published: '2026-10-22'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T20:46:29Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-8cqv-vvq2-6p8c'
references:
  - url: 'https://github.com/lepture/mistune/security/advisories/GHSA-h7ww-273w-6cm8'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115355'
  - url: >-
      https://www.vulncheck.com/advisories/mistune-before-3.3.0-path-traversal-and-xss-via-include-directive
  - url: 'https://github.com/advisories/GHSA-8cqv-vvq2-6p8c'
tags:
  - ghsa
  - pip
ingestedAt: '2026-10-23T21:38:13.044Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references.

## Original Description
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

## Affected packages

- `mistune < 3.3.0`

## Remediation

Refer to the advisory for the patched release.