Mistune CVE-2026-115354

Exploitation requires two specific, non-default conditions, both documented by the GHSA advisory: (1) the application must explicitly enable the opt-in Include directive via RSTDirective([Include()]); and (2) attacker-controlled Markdown must be rendered through Markdown.read(path), which seeds state.env['__file__'] from the caller-supplied file path - passing the Markdown as a plain string does NOT trigger the flaw. Under those conditions the include target is resolved with os.path.join(os.path.dirname(source_file), relpath) and os.path.normpath with no root restriction or allowlist, so relative (../secret.txt) or absolute (/etc/passwd) paths are read. Limiting factors: disclosure is bounded by files readable by the rendering process; the secondary HTML/script injection impact only applies when the included non-Markdown file contains markup (emitted unescaped inside <pre class="directive-include">). The only complete fix per the evidence is upgrading to Mistune 3.3.0.

The CVSS 4.0 base score is 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P, impact VC:H only), indicating a network-reachable confidentiality issue requiring passive user/operator interaction and no attacker authentication. No EPSS probability and no KEV listing were supplied, and there is no CISA KEV entry, so there is no evidence of active exploitation; the exploitation status is that a complete, working public PoC exists (the GHSA advisory embeds a runnable exploit script plus example output disclosing /etc/passwd). The vuln.today Decision label is 'this_week', consistent with a serious but non-emergency item. The dominant risk-limiting factor is the integration precondition: the flaw only manifests when an application has explicitly opted into RSTDirective([Include()]) AND renders attacker-controlled Markdown via Markdown.read(path). This sharply narrows the real-world exposure relative to the 7.1 headline - most Mistune deployments do not enable the Include directive and do not feed attacker files through Markdown.read(). Where that pattern does exist, exploitation is trivial and reliable. Net: a genuine, well-documented local-file-disclosure (with secondary HTML/script injection) bug that is high priority for the specific integrations matching the precondition, but not a mass-exploitation threat for the general population. No signals conflict; the main caveat is that EPSS/KEV data were simply not provided and should not be read as 'low risk by omission'.

An application enables Mistune's opt-in Include directive and lets untrusted users submit Markdown files that it renders via Markdown.read(path). An attacker uploads attacker.md containing .. include:: /etc/passwd (or a relative path like ../secret.txt); when the file is parsed, Mistune resolves the path, reads the target, and embeds its contents verbatim into the rendered output, disclosing the file and, if the included content contains markup, injecting unescaped HTML/script. A complete working PoC script demonstrating /etc/passwd disclosure is published in the GHSA advisory.