Path Traversal and XSS Vulnerability in Mistune by Lepture

CVE-2026-115355

What is CVE-2026-115355?

Mistune, prior to version 3.3.0, is susceptible to a path traversal vulnerability through its Include directive. This flaw enables malicious actors to read arbitrary files by introducing '../' sequences into include paths. Additionally, attackers can exploit this vulnerability to execute cross-site scripting (XSS) attacks by injecting HTML through unescaped error messages and contents of included files, even when the escape option is enabled. Such exploits pose significant risks to the security of applications relying on this markdown parser.

References