CVE-2026-115354
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 22, 2026
Vendor
unknown
Description
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.