EUVD-2026-108425

Mistune: Path Traversal and XSS in Include directive...

Mistune: Path Traversal and XSS in Include directive

The Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files. Additionally, error messages and included file contents are rendered without HTML escaping...

GHSA-H7WW-273W-6CM8 Mistune: Path Traversal and XSS in Include directive

The Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files. Additionally, error messages and included file contents are rendered without HTML escaping...

SUSE CVE-2026-115355

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripti...

CVE-2026-115354

A flaw was found in mistune. When the opt-in Include directive is enabled, insufficient path validation allows an attacker to perform path traversal by supplying relative or absolute file paths. An attacker who submits crafted Markdown input can exploit this flaw to read arbitrary local files fro...

Linux Distros Unpatched Vulnerability : CVE-2026-115350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw...

Linux Distros Unpatched Vulnerability : CVE-2026-115354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or...

Linux Distros Unpatched Vulnerability : CVE-2026-115355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences i...

Linux Distros Unpatched Vulnerability : CVE-2026-115353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or...

CVE-2026-115355

A flaw was found in Mistune. A remote attacker can exploit a path traversal vulnerability in the Include directive by supplying manipulated file paths to access and read arbitrary files on the system. Furthermore, an attacker can inject malicious content through unescaped error messages and...

Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references. Original Description Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read...

DEBIAN-CVE-2026-115354

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read can disclose files such as /etc/passwd and inject...

DEBIAN-CVE-2026-115353

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensiti...

DEBIAN-CVE-2026-115355

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripti...

CVE-2026-115355

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripti...

CVE-2026-115354

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read can disclose files such as /etc/passwd and inject...

DEBIAN-CVE-2026-115350

Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw blockhtml tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path...

CVE-2026-115350

Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw blockhtml tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path...

CVE-2026-115355 Mistune before 3.3.0 Path Traversal and XSS via Include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripti...

EUVD-2026-108423

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read can disclose files such as /etc/passwd and inject...