Most recent entries from all

BREW-adr-viewer-CVE-2026-115355 — Mistune: Path Traversal and XSS in Include directive

Affected: Homebrew: adr-viewer

The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within the source directory, allowing path traversal via `../` sequences to read arbitrary files.

Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when `escape=True`.

Affected functions: - Path resolution (lines 27-31) - `block_error()` in html.py (line 140) - `render_html_include()` (line 72)

The Include plugin must be explicitly enabled via the plugins parameter.

fkie_cve-2026-115355

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

Withdrawn: GHSA-8cqv-vvq2-6p8c — Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive

Withdrawn by the publisher.

Affected: PyPI: mistune

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references.

## Original Description Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

UBUNTU-CVE-2026-115355

Affected: Ubuntu:16.04:LTS: mistune, Ubuntu:18.04:LTS: mistune, Ubuntu:20.04:LTS: mistune, Ubuntu:22.04:LTS: mistune, Ubuntu:24.04:LTS: mistune, Ubuntu:26.10: mistune, Ubuntu:26.04:LTS: mistune