CVE-2026-115355: Mistune before 3.3.0 Path Traversal and XSS via Include Directive

Q: Which deployments are exposed to this issue?

Deployments using Mistune before 3.3.0 are affected if they process attacker-controlled Include directive paths or render resulting content where an attacker can influence include errors or included file contents.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs the ability to supply an Include path containing ../ sequences to read files outside the intended directory. For cross-site scripting, they need control over content that reaches unescaped include error messages or included file contents.

Q: Does enabling escape=True prevent exploitation?

No. The cross-site scripting issue can occur through unescaped error messages and included file contents even when escape=True is enabled.

Q: How can I determine whether my application is affected?

Check whether it uses a Mistune version earlier than 3.3.0 and enables or processes Include directives. Review whether untrusted users can influence include paths, included files, or rendered Markdown output.

Published Oct 22, 2026

Updated

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Affected Software

1 affected component

pypi/mistune<3.3.0

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Mistune before 3.3.0 are affected if they process attacker-controlled Include directive paths or render resulting content where an attacker can influence include errors or included file contents.

What does an attacker need to exploit the vulnerability?

An attacker needs the ability to supply an Include path containing ../ sequences to read files outside the intended directory. For cross-site scripting, they need control over content that reaches unescaped include error messages or included file contents.

Does enabling escape=True prevent exploitation?

No. The cross-site scripting issue can occur through unescaped error messages and included file contents even when escape=True is enabled.

How can I determine whether my application is affected?

Check whether it uses a Mistune version earlier than 3.3.0 and enables or processes Include directives. Review whether untrusted users can influence include paths, included files, or rendered Markdown output.

CVE-2026-115355: Mistune before 3.3.0 Path Traversal and XSS via Include Directive

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Does enabling escape=True prevent exploitation?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Does enabling escape=True prevent exploitation?

How can I determine whether my application is affected?