CVE-2026-115353GHSA-9jjx-3hq3-hx4j
Mistune before 3.3.0 Path Traversal via include Directive
lepture mistune
CVSS
9.2CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.3.0mistuneCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.
Text from CVE List
Affected versions 2
- mistuneaffected: all versions before 3.3.0CVE List
- mistuneunaffected: 3.3.0CVE List