Zero Radar
← feed
HighVulnerabilityCVE-2026-115355updated 25 Oct 2026, 13:32 UTC

Mistune Markdown library can leak local files and allow script injection

A Python tool that turns Markdown into web pages can be tricked into reading files on the server it runs on, and into showing harmful script to visitors. This is only a problem if the Include feature is turned on.

Fixed in mistune 3.3.0Official, 2 sources
SeverityHighCVSS 8.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesmistune 3.3.0 · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker submits MarkdownContent contains ../ include paths
  2. 2Include directive runsPath is not checked against source directory
  3. 3Server reads fileArbitrary local files are opened
  4. 4Unescaped output renderedFile contents and errors inserted as raw HTML
  5. 5Script runs for visitorXSS even when escape=True
  6. ResultAttacker reads server files and runs scripts

What happened

Mistune's Include directive does not check that resolved file paths stay inside the source directory, enabling path traversal with ../ sequences. Error messages and included file contents are also rendered without HTML escaping, causing XSS even when escape=True.

Why it is dangerous: Attackers who can supply Markdown content can read arbitrary server files and inject scripts into pages viewed by other users. Sites that accept untrusted Markdown with the Include plugin enabled are at risk.

Are you affected?

You are affected if you use mistune 3.2.0 or earlier with the Include directive plugin explicitly enabled via the plugins parameter.

Package / productAffected versionsFixed in
mistune · pip<= 3.2.03.3.0

What to do

  1. Update mistune to 3.3.0 or later
  2. If you cannot update now, remove the Include plugin from the plugins parameter
  3. Review any user-supplied Markdown handling to make sure untrusted users cannot trigger includes

Timeline

  1. 22 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 22 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  3. 23 Oct 2026, 20:46 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115355 · GHSA-h7ww-273w-6cm8
CVSS
8.7 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 19:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Mistune Markdown library can leak local files and allow script injection · Zero Radar