## Mistune: Path Traversal and XSS in Include directive

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-115355
- 公開日時: 2026-10-23T20:46:47.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-h7ww-273w-6cm8)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-h7ww-273w-6cm8

影響: pip:mistune <= 3.2.0 → 3.3.0
The Include directive in src/mistune/directives/include.py does not validate that the resolved file path stays within the source directory, allowing path traversal via ../ sequences to read arbitrary files. Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when escape=True. Affected functions: - Path resolution (lines 27-31) - block_error() in html.py (line 140) - render_html_include() (line 72) The Include plugin must be explicitly…