Mistune CVE-2026-115355

Exploitation requires the Include directive plugin to be explicitly enabled via mistune's plugins parameter - this is not a default configuration - and the application must parse attacker-influenced markdown. For the path traversal, the attacker supplies ../ sequences in an include path within that markdown to escape the intended source directory and read arbitrary files relative to it. For the XSS, the output must be rendered in a victim's browser, and the issue persists even when escape=True because error messages and included file contents are emitted without HTML escaping. The primary limiting factor is the non-default plugin requirement; where the Include plugin is not enabled, the application is not exposed.

The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H, score 8.7) rates this network-reachable, low-complexity, and requiring no privileges or user interaction, with high confidentiality impact only. This aligns with the path traversal primitive (arbitrary file read via ../ sequences). However, two signals qualify the raw score. First, the GHSA advisory confirms the Include plugin must be explicitly enabled via the plugins parameter - it is NOT a default configuration - so the network/no-privilege profile only materializes where an application both enables that plugin AND parses attacker-controlled markdown. Second, the provided vector marks VI:N despite the description clearly documenting XSS (HTML injection even when escape=True), so the vector arguably understates integrity impact. No EPSS score was provided (missing, not low), the CVE is not listed in CISA KEV, and the references are vendor/coordinator advisories rather than confirmed working exploit code; therefore this is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', consistent with a serious but not emergency-level priority. Net: a genuine high-severity library flaw whose real-world exploitability is gated by a non-default plugin configuration and attacker-controlled input, rather than a flaw affecting every mistune deployment.

An application uses mistune (<= 3.2.0) with the Include directive plugin explicitly enabled to render user-submitted or externally-sourced markdown. An attacker submits markdown containing an Include directive with ../ sequences, causing the parser to resolve a path outside the intended source directory and return the contents of an arbitrary file (e.g. configuration or credential files); the attacker can alternatively inject HTML through unescaped error messages or included file content to achieve XSS in a viewer's browser. No public working exploit code is identified at time of analysis, only coordinator advisories.