{"id":"ghsa-ghsa-h7ww-273w-6cm8","seq":661339,"kind":"advisory","title":"Mistune: Path Traversal and XSS in Include directive","url":"https://github.com/advisories/GHSA-h7ww-273w-6cm8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-h7ww-273w-6cm8","summary":"影響: pip:mistune <= 3.2.0 → 3.3.0\nThe Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files. Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when escape=True. Affected functions: - Path resolution (lines 27-31) - block_error() in html.py (line 140) - render_html_include() (line 72) The Include plugin must be explicitly…","severity":"high","techs":["python"],"cves":["CVE-2026-115355"],"tags":["GHSA-h7ww-273w-6cm8","mistune"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:46:47.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}