CVE-2026-115355: Mistune before 3.3.0 Path Traversal and XSS via Include Directive
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
Other sources
The Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files.
Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when escape=True.
Affected functions: - Path resolution (lines 27-31) - blockerror() in html.py (line 140) - renderhtmlinclude() (line 72)
The Include plugin must be explicitly enabled via the plugins parameter.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mistuneto a version that resolves this vulnerability.Fixed in 3.3.0 - Upgrade
Upgrade
debian/mistuneto a version that resolves this vulnerability.Fixed in 3.4.0-1 - Upgrade
Upgrade
mistuneto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Mistune before 3.3.0 are affected if they process attacker-controlled Include directive paths or render resulting content where an attacker can influence include errors or included file contents.
What does an attacker need to exploit the vulnerability?
An attacker needs the ability to supply an Include path containing ../ sequences to read files outside the intended directory. For cross-site scripting, they need control over content that reaches unescaped include error messages or included file contents.
Does enabling escape=True prevent exploitation?
No. The cross-site scripting issue can occur through unescaped error messages and included file contents even when escape=True is enabled.
How can I determine whether my application is affected?
Check whether it uses a Mistune version earlier than 3.3.0 and enables or processes Include directives. Review whether untrusted users can influence include paths, included files, or rendered Markdown output.