CVE-2026-115354: Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-22 · updated 2026-10-29
Weakness: CWE-22

Description

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.

Affected products

lepture mistune: before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: lepture mistune 3.3.0. Check the vendor advisory for mitigations.

References

https://github.com/lepture/mistune/security/advisories/GHSA-jhcm-5rpf-j3wv
https://www.vulncheck.com/advisories/mistune-before-3.3.0-arbitrary-local-file-read-via-include-directive
https://github.com/lepture/mistune/security/advisories/GHSA-jhcm-5rpf-j3wv

Get alerted when CVE-2026-115354 or the next vulnerability affects your stack