CVE-2026-115354

Deferred Deferred - Pending Action

Path Traversal in Mistune Markdown Parser

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-115354

Affected Vendors & Products

Vendor	Product	Version / Range
lepture	mistune	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Mistune before 3.3.0 has a path traversal flaw in its Include directive. This allows attackers to read local files by providing relative or absolute paths. When Markdown is processed via Markdown.read(), it may expose sensitive files like /etc/passwd and inject unescaped HTML or script content into the output.

Detection Guidance

Check Mistune version with pip show mistune. If version is below 3.3.0, the system is vulnerable. Inspect Markdown files for Include directive usage with suspicious paths like ../ or absolute paths.

Impact Analysis

Attackers could access sensitive files on your system, such as configuration files or user data. They might also inject malicious scripts into rendered Markdown, potentially leading to further attacks like cross-site scripting (XSS) or data theft.

Mitigation Strategies

Upgrade Mistune to version 3.3.0 or later. Review and sanitize all Markdown input to prevent path traversal. Disable Include directive if not needed.

Hi! I’m here to help you understand CVE-2026-115354. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70