https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-27T17:25:34.714998+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-adr-viewer-cve-2026-115355 BREW-adr-viewer-CVE-2026-115355 — Mistune: Path Traversal and XSS in Include directive 2026-10-27T17:25:34.796313+00:00

Affected: Homebrew: adr-viewer

The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within the source directory, allowing path traversal via `../` sequences to read arbitrary files.

Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when `escape=True`.

Affected functions: - Path resolution (lines 27-31) - `block_error()` in html.py (line 140) - `render_html_include()` (line 72)

The Include plugin must be explicitly enabled via the plugins parameter.

 https://db.gcve.eu/vuln/fkie_cve-2026-115355 fkie_cve-2026-115355 2026-10-27T17:25:34.796390+00:00

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

 https://db.gcve.eu/vuln/ghsa-8cqv-vvq2-6p8c Withdrawn: GHSA-8cqv-vvq2-6p8c — Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive 2026-10-27T17:25:34.796423+00:00

Withdrawn by the publisher.

Affected: PyPI: mistune

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references.

## Original Description Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-115355 UBUNTU-CVE-2026-115355 2026-10-27T17:25:34.796454+00:00

Affected: Ubuntu:16.04:LTS: mistune, Ubuntu:18.04:LTS: mistune, Ubuntu:20.04:LTS: mistune, Ubuntu:22.04:LTS: mistune, Ubuntu:24.04:LTS: mistune, Ubuntu:26.10: mistune, Ubuntu:26.04:LTS: mistune

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.