{"schema":"threatline.record/2","record":{"id":"CVE-2026-115355","aliases":["GHSA-h7ww-273w-6cm8"],"summary":"Mistune: Path Traversal and XSS in Include directive","details":"The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within the source directory, allowing path traversal via `../` sequences to read arbitrary files.\n\nAdditionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when `escape=True`.\n\nAffected functions:\n- Path resolution (lines 27-31)\n- `block_error()` in html.py (line 140)\n- `render_html_include()` (line 72)\n\nThe Include plugin must be explicitly enabled via the plugins parameter.","categories":["Libraries & packages"],"product":"mistune","vendor":"lepture","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h7ww-273w-6cm8","source_modified_at":"2026-10-23T20:46:48Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"pip","name":"mistune"},"range":"<= 3.2.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115355","source_modified_at":"2026-10-22T19:13:31.904Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"mistune","vendor":"lepture","versions":[{"lessThan":"3.3.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.3.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-h7ww-273w-6cm8","source_modified_at":"2026-10-23T21:00:06.308204078Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"name":"mistune","ecosystem":"PyPI","purl":"pkg:pypi/mistune"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.3.1","0.4","0.4.1","0.5","0.5.1","0.6","0.7","0.7.1","0.7.2","0.7.3","0.7.4","0.8","0.8.1","0.8.2","0.8.3","0.8.4","2.0.0","2.0.0a1","2.0.0a2","2.0.0a3","2.0.0a4","2.0.0a5","2.0.0a6","2.0.0rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.1.0","3.0.0","3.0.0a1","3.0.0a2","3.0.0a3","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.0.0rc4","3.0.0rc5","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h7ww-273w-6cm8","source_modified_at":"2026-10-23T20:46:48Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"pip","name":"mistune"},"version":"3.3.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115355","source_modified_at":"2026-10-22T19:13:31.904Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"mistune","ecosystem":null},"version":"3.3.0","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-h7ww-273w-6cm8","source_modified_at":"2026-10-23T21:00:06.308204078Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"name":"mistune","ecosystem":"PyPI","purl":"pkg:pypi/mistune"},"version":"3.3.0"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00387,"percentile":0.31651,"score_date":"2026-10-23"},"published_at":"2026-10-22T19:13:31.904Z","modified_at":"2026-10-23T21:00:06.308204078Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-h7ww-273w-6cm8","fetched_at":"2026-10-23T21:10:45.942435Z","source_modified_at":"2026-10-23T20:46:48Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115355","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T19:13:31.904Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-h7ww-273w-6cm8","fetched_at":"2026-10-23T21:10:45.942435Z","source_modified_at":"2026-10-23T21:00:06.308204078Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115355","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/lepture/mistune/security/advisories/GHSA-h7ww-273w-6cm8","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115355","source":"GitHub Advisory Database"},{"url":"https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993","source":"GitHub Advisory Database"},{"url":"https://github.com/lepture/mistune/releases/tag/v3.3.0","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/mistune-before-3.3.0-path-traversal-and-xss-via-include-directive","tags":["third-party-advisory"]},{"url":"https://github.com/advisories/GHSA-h7ww-273w-6cm8","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T21:00:06.308204078Z","content_hash":"f78d0ac655fa0e4686acbc5b080af2faa167a2d3c21e6a9ec88b91cf5d53a551"}}