Mistune: Path Traversal and XSS in Include directive

Description

References

• lepture/mistune security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2026-115355 · ADVISORY
• lepture/mistune commit 1bef343 · WEB
• lepture/mistune · PACKAGE
• lepture/mistune release v3.3.0 · WEB
• vulncheck.com/advisories/mistune-before-3.3.0-path-traversal-and-xss-via-include-directive · WEB

Weitere Schwachstellen in mistune

• CVE-2026-76098HOCH 7.5Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tok…
• CVE-2026-59930MITTEL 4.3Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate headin…
• CVE-2026-59929MITTEL 6.1Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks …
• CVE-2026-59928HOCH 7.5Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct ref…
• CVE-2026-59927MITTEL 5.3Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py d…