CVE-2026-115350: Mistune before 3.3.0 Stored XSS via Include Directive HTML Files
Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw blockhtml tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path traversal, to execute stored scripts when escape=False is set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mistuneto a version that resolves this vulnerability.Fixed in 3.4.0-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Mistune before 3.3.0 are exposed when the Include directive is enabled or available, rendering is performed with escape=False, and an attacker can cause a readable HTML-family file to be included.
What does an attacker need to exploit it?
The attacker needs to plant an .html, .xhtml, or .htm file that the renderer can read, then reference it through an include directive. The issue can be combined with path traversal to reach the planted file.
Is a default escaped rendering configuration affected?
The provided information identifies exploitation when escape=False is set. It does not establish that rendering with escaping enabled is affected.