CVE-2026-115350GHSA-96vr-jm8v-g22j
Mistune before 3.3.0 Stored XSS via Include Directive HTML Files
lepture mistune
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.3.0mistuneCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path traversal, to execute stored scripts when escape=False is set.
Text from CVE List
Affected versions 2
- mistuneaffected: all versions before 3.3.0CVE List
- mistuneunaffected: 3.3.0CVE List