GHSA-8cqv-vvq2-6p8c: Path Traversal

Q: Which Mistune versions should be remediated?

Mistune versions before 3.3.0 are affected. Upgrade to version 3.3.0 or later.

Q: What attacker-controlled input is required for exploitation?

An attacker needs to be able to supply paths used by the Include directive. ../ sequences in those paths can be used to read arbitrary files.

Q: Does enabling escape=True prevent the cross-site scripting risk?

No. HTML can still be injected through unescaped error messages and included file contents even when escape=True is set.

Q: Should this advisory be tracked independently?

No. This advisory was withdrawn as a duplicate of GHSA-h7ww-273w-6cm8 and is retained only for external references.

Published Oct 22, 2026

Updated

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references.

Original Description Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Affected Software

1 affected component

pip/mistune<3.3.0

Event History

Oct 22, 2026

Advisory Published

via GitHub·09:32 PM

Data Sourced

via GitHub·09:32 PM

DescriptionSeverityWeaknessAffected Software

Oct 23, 2026

Withdrawn

via GitHub·08:46 PM

Frequently Asked Questions

Which Mistune versions should be remediated?

Mistune versions before 3.3.0 are affected. Upgrade to version 3.3.0 or later.

What attacker-controlled input is required for exploitation?

An attacker needs to be able to supply paths used by the Include directive. ../ sequences in those paths can be used to read arbitrary files.

Does enabling escape=True prevent the cross-site scripting risk?

No. HTML can still be injected through unescaped error messages and included file contents even when escape=True is set.

Should this advisory be tracked independently?

No. This advisory was withdrawn as a duplicate of GHSA-h7ww-273w-6cm8 and is retained only for external references.

GHSA-8cqv-vvq2-6p8c: Path Traversal

Affected Software

Event History

Frequently Asked Questions

Which Mistune versions should be remediated?

What attacker-controlled input is required for exploitation?

Does enabling escape=True prevent the cross-site scripting risk?

Should this advisory be tracked independently?

Company

Resources

Contact

Frequently Asked Questions

Which Mistune versions should be remediated?

What attacker-controlled input is required for exploitation?

Does enabling escape=True prevent the cross-site scripting risk?

Should this advisory be tracked independently?