EUVD-2026-108422

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensiti...

CVE-2026-115353

The Mistune markdown processor (versions before 3.3.0 ) is vulnerable to a path traversal vulnerability in the RST include directive . An attacker can exploit this by submitting markdown containing include directives with relative paths (e.g., ../ sequences) or absolute paths . This allows the at...