CVE-2026-115355
CVE-2026-115355 · Mistune before 3.3.0 Path Traversal and XSS via Include Directive
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
CVSS 8.7 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
mistune
- Versions
- ≥ 0, < 3.3.0: Affected (semver)
- 3.3.0: Not affected (semver)
Update to 3.3.0
mistune Debian:12
- Versions
- 2.0.4-1
- 2.0.4-2
- 3.0.2-1
- 3.0.2-2
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Debian:13
- Versions
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune Debian:14
- Versions
- 3.1.3-1
- 3.1.4-1
- 3.3.4-1
- 3.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mistune PyPI
- Versions
- 0.1.0
- 0.2.0
- 0.3.0
- 0.3.1
- 0.4
- 0.4.1
- 0.5
- 0.5.1
- 0.6
- 0.7
- 0.7.1
- 0.7.2
- 0.7.3
- 0.7.4
- 0.8
- 0.8.1
- 0.8.2
- 0.8.3
- 0.8.4
- 2.0.0
- 2.0.0a1
- 2.0.0a2
- 2.0.0a3
- 2.0.0a4
- 2.0.0a5
- 2.0.0a6
- 2.0.0rc1
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.4
- 2.0.5
- 2.1.0
- 3.0.0
- 3.0.0a1
- 3.0.0a2
- 3.0.0a3
- 3.0.0rc1
- 3.0.0rc2
- 3.0.0rc3
- 3.0.0rc4
- 3.0.0rc5
- 3.0.1
- 3.0.2
- 3.1.0
- 3.1.1
- 3.1.2
- 3.1.3
- 3.1.4
- 3.2.0
- 3.2.1
- Affected ranges
- ECOSYSTEM: < 3.3.0
Update to 3.3.0