Mistune CVE-2026-115350

Exploitation requires ALL of the following, drawn from the advisory: (1) the mistune renderer is constructed with escape=False - a documented and vendor-recommended setting for sites that trust their markdown corpus, but NOT the default; (2) the Include directive is enabled via RSTDirective([Include()]); (3) the filesystem rendering context is active, i.e. state env '__file__' is set so include paths resolve; (4) the attacker can write a file with a .html/.xhtml/.htm extension to any location readable by the rendering process (via an upload form that doesn't check content type, log-file injection, or a separate write primitive); and (5) the attacker can submit markdown that references that file, using path traversal ('../') per the companion advisory to reach it outside the source directory. A victim must then view the rendered page (UI/passive interaction) for the stored script to run. LIMITING FACTORS that reduce real-world risk: with the default escape=True, the included HTML is entity-escaped and the attack fails entirely; without a usable file-plant primitive the chain cannot start; and the Include directive must be explicitly enabled.

This is a genuinely medium-severity, highly conditional stored XSS rather than a broad emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:L/VI:L/SC:L/SI:L) yields 5.3 and models low confidentiality/integrity impact on both the vulnerable system and a subsequent system (the victim browser), consistent with XSS. However, the AC:L rating understates reality: the advisory itself establishes that exploitation requires the operator to have set escape=False (a documented but non-default configuration), the Include/RSTDirective to be enabled, and the attacker to first obtain a file-write primitive to plant a .html file readable by the renderer (the advisory explicitly chains this with a separate path-traversal flaw). Those stacked, partly attacker-uncontrolled preconditions argue for AC:H, which the vendor vector does not reflect - a signal worth flagging to defenders. No EPSS score and no KEV status are present in the input, so there is no evidence of active or at-scale exploitation; the vuln.today decision label is 'this_month', not act_now/emergency. Working proof-of-concept code is published in the GHSA advisory (verified against mistune 3.2.1), so exploitability is demonstrated even though mass exploitation is not indicated. Net: real but not urgent - prioritize for the normal monthly patch cycle, with escalation only for deployments known to run escape=False plus the Include directive.

A knowledge-base or wiki platform renders user markdown with mistune configured escape=False and the Include directive enabled. An attacker uploads a file with a .html extension (e.g. via an avatar/attachment form that doesn't validate content type) containing a <script> payload, then submits markdown using '.. include:: ../../path/payload.html' with path traversal to reach it; mistune emits the file verbatim as a raw block_html token and the script executes in the site's origin when any user views the page. Publicly available exploit code exists in the vendor GHSA advisory, verified against mistune 3.2.1.