CVE-2026-115354: Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

Q: Which deployments are exposed?

Deployments using Mistune before 3.3.0 are exposed only when the opt-in Include directive is enabled and attacker-controlled Markdown is rendered through Markdown.read().

Q: What does an attacker need to exploit this issue?

An attacker needs to be able to submit Markdown that is processed by Markdown.read(), and must be able to supply a relative or absolute path in an Include directive. No authentication or other privileges are indicated by the provided vector, although user interaction is required.

Q: What can an attacker obtain or inject?

The issue can disclose local files accessible to the rendering process, including files such as /etc/passwd. Included content can also introduce unescaped HTML or script content into the rendered output.

Q: What can be done if upgrading is not immediately possible?

Disable or avoid the opt-in Include directive for untrusted Markdown, and do not render attacker-controlled Markdown through Markdown.read() where include paths can be supplied.

Published Oct 22, 2026

Updated

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.

Affected Software

1 affected component

pypi/mistune<3.3.0

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using Mistune before 3.3.0 are exposed only when the opt-in Include directive is enabled and attacker-controlled Markdown is rendered through Markdown.read().

What does an attacker need to exploit this issue?

An attacker needs to be able to submit Markdown that is processed by Markdown.read(), and must be able to supply a relative or absolute path in an Include directive. No authentication or other privileges are indicated by the provided vector, although user interaction is required.

What can an attacker obtain or inject?

The issue can disclose local files accessible to the rendering process, including files such as /etc/passwd. Included content can also introduce unescaped HTML or script content into the rendered output.

What can be done if upgrading is not immediately possible?

Disable or avoid the opt-in Include directive for untrusted Markdown, and do not render attacker-controlled Markdown through Markdown.read() where include paths can be supplied.

CVE-2026-115354: Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What can an attacker obtain or inject?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What can an attacker obtain or inject?

What can be done if upgrading is not immediately possible?