Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Mistune lets attackers read files and inject scripts

published 13 days ago
Summary

The Mistune library (versions before 3.3.0) can be tricked into loading any file on the server by using "../" paths, and it can also display unsanitized content that allows malicious code to run in a user's browser. This could expose sensitive data and enable phishing or other attacks. Upgrade Mistune to version 3.3.0 or later, and review any custom include functionality for safe handling of file paths.

What to do
  • Update hsiaoming yang mistune to version 3.3.0 or later.
Affected software
Ecosystem VendorProductAffected versions
pip hsiaoming yang mistune < 3.3.0
Original advisory text
Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references.

## Original Description
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.7 High
Type
CWE-22Path Traversal
Timeline
Published22 Oct 2026
Updated23 Oct 2026
First seen23 Oct 2026
Sources
GHSA-8cqv-vvq2-6p8c · GHSA
Track software like this
Free during beta