GHSA-H7WW-273W-6CM8 Mistune: Path Traversal and XSS in Include directive

The Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files. Additionally, error messages and included file contents are rendered without HTML escaping...

EUVD-2026-108425

Mistune: Path Traversal and XSS in Include directive...

Mistune: Path Traversal and XSS in Include directive

The Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files. Additionally, error messages and included file contents are rendered without HTML escaping...

SUSE CVE-2026-115355

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripti...

CVE-2026-115354

A flaw was found in mistune. When the opt-in Include directive is enabled, insufficient path validation allows an attacker to perform path traversal by supplying relative or absolute file paths. An attacker who submits crafted Markdown input can exploit this flaw to read arbitrary local files fro...

CVE-2026-115351

A flaw was found in mistune. A remote attacker with control over markdown content can cause information disclosure by performing Cascading Style Sheets CSS injection through the unvalidated figwidth option in the figure directive. By inserting arbitrary style rules into rendered web pages, the...

CVE-2026-115350

A flaw was found in mistune. An attacker can exploit this vulnerability to conduct stored Cross-Site Scripting XSS attacks through the file inclusion directive. By referencing a crafted HTML file, unescaped content is processed as raw markup, enabling the execution of arbitrary script code in the...

CVE-2026-115355

A flaw was found in Mistune. A remote attacker can exploit a path traversal vulnerability in the Include directive by supplying manipulated file paths to access and read arbitrary files on the system. Furthermore, an attacker can inject malicious content through unescaped error messages and...

CVE-2026-115348

A flaw was found in mistune. A remote, unauthenticated attacker can exploit an algorithmic complexity vulnerability in the inline link parser by submitting specially crafted Markdown input containing numerous unbalanced brackets. This forces repeated forward scans during text parsing, consuming...

CVE-2026-115347

A flaw was found in mistune. A remote attacker can exploit an inefficient algorithmic complexity issue in the link text parsing logic by submitting specially crafted Markdown input containing long sequences of unmatched square brackets. Processing this input causes repeated forward scans, leading...

CVE-2026-115352

A flaw was found in mistune. This algorithmic complexity vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by submitting specially crafted Markdown input containing long sequences of unmatched bracket characters. When parsing this malformed input, the inline...

CVE-2026-115349

A flaw was found in mistune. This flaw allows a remote attacker to cause a Denial of Service DoS by submitting crafted Markdown input containing deeply nested square brackets. Processing this input triggers inefficient parsing behavior in the link text parser, exhausting server processor resource...

Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references. Original Description Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read...

DEBIAN-CVE-2026-115352

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '' characters. Attackers can send small markdown payloads that trigger ON^2 parselinktext and parselinklabel...

DEBIAN-CVE-2026-115354

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read can disclose files such as /etc/passwd and inject...

DEBIAN-CVE-2026-115353

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensiti...

DEBIAN-CVE-2026-115355

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripti...

CVE-2026-115355

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripti...

CVE-2026-115352

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '' characters. Attackers can send small markdown payloads that trigger ON^2 parselinktext and parselinklabel...

CVE-2026-115354

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read can disclose files such as /etc/passwd and inject...