CVE-2026-115353High· 8.6▾ TwilightMistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
0.4% → 0.4%
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.
mistune < 3.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115355High· 7.5Mistune: Path Traversal and XSS in Include directive
CVE-2026-115354Medium· 6.5Mistune before 3.3.0 Arbitrary Local File Read via Include Directive
GHSA-8cqv-vvq2-6p8cHigh· 7.5Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive
CVE-2026-115352High· 7.5Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
CVE-2026-115347High· 7.5Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
CVE-2026-115348High· 7.5Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text