CVE-2026-115353: critical vulnerability in lepture mistune
Mistune before 3.3.0 Path Traversal via include Directive
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.2epss 0.4%
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
lepture · mistuneRelated CVEs — lepture mistune
In the same product, most dangerous first.
CVE-2026-59928HIGHMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsEPSS 0.7%CVE-2026-59925HIGHinline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsEPSS 0.6%CVE-2026-59922HIGHMistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)EPSS 0.6%CVE-2026-121437HIGHMistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimitersEPSS 0.6%CVE-2026-33079HIGHMistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titlesEPSS 0.6%CVE-2026-59927MEDIUMMistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown filesEPSS 0.5%