Cross-Site Scripting Vulnerability in Mistune by Lepture

CVE-2026-115350

What is CVE-2026-115350?

Mistune versions below 3.3.0 are susceptible to a cross-site scripting vulnerability that arises from the Include directive. This flaw permits attackers to incorporate HTML files (.html, .xhtml, or .htm) that can execute stored scripts when the escape parameter is set to False. By exploiting this vulnerability in conjunction with path traversal techniques, an attacker can manipulate the content rendered by the Mistune library, leading to the execution of malicious scripts and potentially compromising user data and session integrity.

References