Advisory · CVE-2026-115355
Mistune include directive also leaks files and injects unescaped HTML even with escaping on
Mistune before 3.3.0 does not validate that include directive paths stay within the source directory, and renders error messages and included file contents without HTML escaping, so attackers can read arbitrary files and perform cross-site scripting even when escape is set to True. CVSS 4.0 8.7.
- Vendor
- Lepture
- Product
- Mistune
- Identifier / CWE
- CVE-2026-115355
CWE-22, CWE-79 - Action timing
- Immediate
Explain it like I’m five
The same include door is missing its fence, and the error notes it posts are written in raw HTML, so even sites that turned on the safety setting for escaping still show attacker content exactly as written.
- 01Application renders markdown with includes
An application uses Mistune with the Include plugin explicitly enabled, rendering markdown that an attacker can influence.
- 02Attacker includes an outside file
The attacker uses traversal sequences in an include path to reference a file outside the source directory, which the plugin does not validate against the source directory, per the Mistune advisory.
- 03Contents and errors render unescaped
Per the advisory, error messages and included file contents are rendered without HTML escaping, leading to cross-site scripting even when escape is set to True.
- 04Reader sessions are exposed
The rendered page discloses the included file and can execute attacker script in the sessions of users who view it.
What happened
The Mistune project disclosed CVE-2026-115355 in its GitHub security advisory: the Include directive does not validate that the resolved file path stays within the source directory, allowing path traversal via dot-dot sequences to read arbitrary files. Additionally, per the advisory, error messages and included file contents are rendered without HTML escaping, leading to cross-site scripting even when escape is set to True. The CVE record lists Mistune before 3.3.0 as affected, with 3.3.0 as the fixed release. The CVSS 4.0 score is 8.7 and the CVSS 3.1 score is 7.5.
Per the advisory, the affected code is the path resolution in the include directive together with the error and include rendering in the HTML renderer, and the Include plugin must be explicitly enabled through the plugins parameter. This CVE is the companion record to a separate include directive file read advisory for the same plugin in the same release window; the distinguishing impact here is that the escaping failure defeats the escape setting applications may already rely on, so enabling escaping is not a mitigation for this issue.
What to do
- Inventory Python applications that use Mistune with the Include plugin enabled, including documentation and preview renderers.
- Upgrade Mistune to 3.3.0 or later in every affected application, using the project release guidance.
- Until upgraded, disable the Include plugin for untrusted markdown; do not rely on the escape setting as a mitigation, because the advisory states the XSS occurs even with escape set to True.
- Hunt rendered output for include directives with traversal sequences and for unescaped HTML originating from include errors or included files.
- Review pages rendered from untrusted markdown for stored script content, and verify the deployed Mistune version after updating.
Management note
The uncomfortable part is the failed safety setting: teams that deliberately enabled escaping still got script injection through the error path. Patch to 3.3.0 and sweep already-rendered pages, because stored content stays stored.