CVE-2026-115350: Mistune cross-site scripting in Include directive for HTML files

CVE-2026-115350 · Severity: medium · CVSS 6.1 · Published 2026-10-22

Mistune is a Markdown parser library used by documentation and knowledge-base platforms. The Include directive can be exploited to load and render HTML files without proper escaping, allowing an attacker who can place a malicious HTML file on the server to execute arbitrary scripts in users' browsers. This requires the renderer to be configured with escape=False, a common setting on sites that intentionally support inline HTML in Markdown.

Technologies: Lepture Mistune. Vendors: Lepture.

Quick answers

Is CVE-2026-115350 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115350 being exploited in the wild.
How severe is CVE-2026-115350?
Medium severity, with a CVSS score of 6.1, published 22 October 2026.
Which products and versions are affected?
Lepture Mistune before 3.3.0.
Is there a fix for CVE-2026-115350?
Yes: fixed in 3.3.0. Until then: Set escape=True when constructing the Markdown renderer, or disable the Include directive if inline HTML is not required. Both mitigations prevent unescaped HTML output. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115350 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-115350?
Check whether you run Lepture Mistune at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.3.0

Set escape=True when constructing the Markdown renderer, or disable the Include directive if inline HTML is not required. Both mitigations prevent unescaped HTML output.

Technical details

The vulnerability is a stored XSS in the Include directive's handling of .html, .xhtml, and .htm files. When an included HTML file is processed, it is emitted as a raw block_html token that bypasses HTML escaping when escape=False is set. Combined with path traversal in the Include directive, an attacker can plant a .html file in a readable location (via upload, log injection, or other file-write primitive) and include it via the .. include:: directive with a traversal path to achieve stored XSS.

Affected products

  • lepture Mistune before 3.3.0

Timeline

  • 2026-06-21: disclosed
  • 2026-10-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.