CVE-2026-115354GHSA-jhcm-5rpf-j3wv
Mistune before 3.3.0 Arbitrary Local File Read via Include Directive
lepture mistune
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.3.0mistuneCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.
Text from CVE List
Affected versions 2
- mistuneaffected: all versions before 3.3.0CVE List
- mistuneunaffected: 3.3.0CVE List