CVE-2026-115354 in Mistune
Summary
by MITRE • 10/23/2026
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Mistune library, a popular Python-based Markdown parser, contained a critical path traversal vulnerability in versions prior to 3.3.0 that stemmed from insufficient validation of file paths within its opt-in Include directive. This security flaw allowed attackers who had the ability to submit raw Markdown content for rendering via methods such as Markdown.read() or similar entry points to manipulate the underlying file system access mechanisms. By supplying carefully crafted relative or absolute path strings in include directives, an attacker could bypass intended directory boundaries and traverse up the filesystem hierarchy to access arbitrary files on the host machine where the application was running. This capability effectively turned a text formatting tool into a vector for unauthorized local file disclosure, compromising the confidentiality of sensitive system data such as /etc/passwd or configuration files containing credentials.
The technical root cause lies in how the parser processed include statements without adequately sanitizing path inputs to prevent directory traversal sequences like dot-dot-slash patterns. When an attacker injects these malicious paths into Markdown content that is subsequently rendered, the library attempts to read and embed the contents of the specified file directly into the output stream. Because this process occurs during rendering, it not only results in data exfiltration but also creates a secondary risk vector for Cross-Site Scripting if the included files contain executable script tags or HTML elements. The vulnerability is particularly dangerous because it relies on user-supplied input being processed by the parser, which may occur in web applications that allow users to post formatted text without strict server-side validation of embedded directives.
From an operational perspective, this vulnerability poses a severe risk to any application integrating Mistune for dynamic content generation. Successful exploitation can lead to complete disclosure of sensitive information stored on the local file system, potentially exposing database credentials, private keys, or internal network configurations. Furthermore, if the rendered output is served back to web users without proper escaping, the inclusion of arbitrary HTML or script from external files can facilitate persistent cross-site scripting attacks against end-users interacting with the application. This dual nature of the flaw—combining local file read capabilities with potential remote code execution via injected scripts—significantly elevates its severity rating in real-world scenarios where user input is not strictly controlled at the ingestion layer.
To mitigate this vulnerability, organizations must immediately upgrade Mistune to version 3.3.0 or later, which includes fixes for path validation logic within the include directive. For applications unable to update promptly due to dependency constraints, implementing strict allow-listing of permitted directories and files that can be included is essential. Input validation should also be enforced at the application level to reject any Markdown content containing suspicious path traversal characters before it reaches the parser. Additionally, ensuring that rendered output undergoes rigorous HTML sanitization can help mitigate the secondary risk of script injection resulting from compromised include operations. Adhering to these practices aligns with industry standards such as CWE-22 for Improper Limitation of a Pathname to a Restricted Directory and mitigates risks associated with ATT&CK technique T1083, which covers File and Directory Discovery in the context of reconnaissance activities following initial access.