Read the docs
TI-2026-79440 Aliases CVE-2026-115353GHSA-pfvv-4pq6-mx74

Path traversal in Mistune include directive lets attackers read files

Priority HIGH 79CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Mistune before 3.3.0 contains a path traversal flaw (CWE-22) in the RST include directive. An unauthenticated remote attacker can submit markdown with include directives that reference ../ sequences or absolute paths, embedding sensitive local files such as credentials or environment data in the rendered HTML.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Fix Partial mistune (lepture): 3.3.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lepturemistunebefore 3.3.03.3.0Patch availableCNA
  • mistune Vendorlepture Affected before 3.3.0 Fixed in 3.3.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*——lepture
  • cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:* Versions — — ·lepture

Remediation

Upgrade lepture mistune to version 3.3.0. The sources list no fixed version for Red Hat OpenShift AI (RHOAI).

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA mistune (lepture) Fixed in 3.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    lepture mistune 3.3.0

    9 records Highest priority Priority HIGH 1 HIGH, 7 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-79441 Path traversal in Mistune lets attackers read local filesPriority MEDIUM 64
    • TI-2026-79438 CSS injection in Mistune figure directive figwidth optionPriority MEDIUM 57
    • TI-2026-79442 Path traversal and XSS in Mistune Include directivePriority MEDIUM 44
    Show all 9 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Not affected: 2 products
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-115353
  2. 2026-10-22 Alias added: GHSA-pfvv-4pq6-mx74
  3. 2026-10-30 Affected versions changed · Red Hat
  4. 2026-10-30 CVSS score added · Red Hat
  5. 2026-11-04 CISA SSVC decision points changed
  6. 2026-11-04 Priority changed: MEDIUM → HIGH

References

Advisory 1

  • TI-2026-36755 Mistune: Potential DoS via quadratic-time parsing in parse_link_text CVSS 4.0HIGH 8.7
  • TI-2026-25521 Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles CVSS 4.0HIGH 8.7
  • TI-2026-53257 Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown CVSS 3.1HIGH 7.5
  • TI-2026-42736 Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions CVSS 3.1HIGH 7.5
  • TI-2026-42730 Regular expression denial of service in lepture mistune CVSS 3.1HIGH 7.5
  • TI-2026-84319 Quadratic-time denial of service in Mistune emphasis processing CVSS 4.0HIGH 8.7
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences