CVE-2026-115350
CVE-2026-115350 · Mistune before 3.3.0 Stored XSS via Include Directive HTML Files
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path traversal, to execute stored scripts when escape=False is set.
CVSS 5.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
mistune
- Versions
- ≥ 0, < 3.3.0: Affected (semver)
- 3.3.0: Not affected (semver)
Update to 3.3.0
mistune Debian:12
- Versions
- 2.0.4-1
- 2.0.4-2
- 3.0.2-1
- 3.0.2-2
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Debian:13
- Versions
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Debian:14
- Versions
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Ubuntu:16.04:LTS
- Versions
- 0.6-2
- 0.7.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Ubuntu:18.04:LTS
- Versions
- 0.7.4-1
- 0.8-1
- 0.8.1-1
- 0.8.3-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Ubuntu:20.04:LTS
- Versions
- 0.8.4-1
- 0.8.4-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Ubuntu:22.04:LTS
- Versions
- 0.8.4-4
- 0.8.4-5
- 2.0.0-1+really0.8.4-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Ubuntu:24.04:LTS
- Versions
- 2.0.4-2
- 3.0.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Ubuntu:26.10
- Versions
- 3.1.4-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Ubuntu:26.04:LTS
- Versions
- 3.1.3-1
- 3.1.4-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published