Mistune CVE-2026-115353

Exploitation requires three concrete conditions, all confirmed by the GHSA advisory: (1) the application must enable the RST Include directive via RSTDirective([Include()]) in its mistune plugin list - this is NOT a default configuration; (2) the integration must set state.env['__file__'] to a filesystem path, which is the documented setup for rendering on-disk markdown and resolving relative includes; and (3) the attacker must be able to supply markdown that this renderer processes. Given those, no authentication or user interaction is needed (vector is PR:N/UI:N) and both '../' relative traversal and absolute paths like '/etc/passwd' work. Files readable are limited to those accessible to the renderer process (e.g. /etc/passwd, /proc/self/environ, the app's .env, ~/.aws/credentials). A second, conditional mode applies only when the application also sets escape=False and the attacker can place a '.html' file, yielding stored XSS. The principal LIMITING factor is that the Include directive is opt-in: deployments that do not enable it, or do not set __file__, are not exploitable.

Signals mostly align toward high priority but with one important caveat. CVSS 4.0 is 9.2 (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H and subsequent-system SC:H), and the vuln.today decision label is act_now, indicating this should be treated as urgent. A working proof-of-concept is published inside the GHSA advisory itself (author-verified against mistune 3.2.1 with ../../../etc/passwd and /etc/passwd payloads), so exploitation is trivial where applicable. Countervailing signals: there is no CISA KEV listing (no confirmed active exploitation) and no EPSS score was supplied, so widespread opportunistic exploitation is not evidenced - treat urgency as driven by ease-of-exploit and PoC availability rather than observed in-the-wild activity. The most important nuance the raw CVSS hides: PR:N/UI:N is accurate only once the application has opted into the non-default RST Include directive and set state.env['__file__']. The base vector does not encode that deployment precondition, so the 9.2 overstates universal risk - for apps that enable the Include plugin it is a trivially exploitable unauthenticated arbitrary-file-read, but apps that never enable it are not exposed. This is a genuine priority for the affected configuration, not a paper high-CVSS issue, but exposure must be confirmed per deployment.

An application renders user-submitted markdown with the RST Include directive enabled and __file__ set to the source path. An attacker submits markdown containing '.. include:: ../../../etc/passwd' (or an absolute path such as '/etc/passwd', which os.path.join resolves verbatim), and the renderer reads the file and embeds its contents in the returned HTML, leaking credentials, .env secrets, or /proc/self/environ. A verified PoC demonstrating both the relative-traversal and absolute-path bypass is published in the GHSA advisory.