CVE-2026-115350Medium· 6.1▾ SunlitA flaw was found in mistune. An attacker can exploit this vulnerability to conduct stored Cross-Site Scripting (XSS) attacks through the file inclusion directive. By referencing a crafted HTML file, unescaped content is processed as raw ma…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Last analysed / modified upstream
0.2%
A flaw was found in mistune. An attacker can exploit this vulnerability to conduct stored Cross-Site Scripting (XSS) attacks through the file inclusion directive. By referencing a crafted HTML file, unescaped content is processed as raw markup, enabling the execution of arbitrary script code in the browser of a user viewing the rendered document.
mistune: mistune: Cross-site scripting via Include directive — rated Moderate by Red Hat. Released 2026-10-22, updated 2026-10-23.
Affected:
No fix planned:
Fix deferred
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115351Medium· 4.7mistune: mistune: Information disclosure via CSS injection in figure directive (CVE-2026-115351)
CVE-2026-114127Medium· 5.4astro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)
CVE-2026-114128Medium· 6.1astro: astro: Cross-Site Scripting via unescaped dynamic content in script and style elements (CVE-2026-114128)
CVE-2026-54527Critical· 9.0jupyterlab-git: jupyterlab-git-core: @jupyterlab/git: JupyterLab Git: Remote Code Execution via crafted Git filenames in commit history (CV…
CVE-2026-116137Low· 3.7adm-zip: adm-zip: File integrity check bypass via duplicate archive entries (CVE-2026-116137)
CVE-2026-116148Low· 3.6ImageMagick: ImageMagick: Command injection via unvalidated drawing options in MVG encoder (CVE-2026-116148)