Is CVE-2026-115355 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115355 being exploited in the wild.

How severe is CVE-2026-115355?

High severity, with a CVSS score of 7.5, published 22 October 2026.

Which products and versions are affected?

Lepture Mistune before 3.3.0; mistune (PyPI) <= 3.2.0, ECOSYSTEM:introduced=0,fixed=3.3.0.

Is there a fix for CVE-2026-115355?

Yes. mistune (PyPI): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115355 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115355?

Check whether you run Lepture Mistune or mistune (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115355: Mistune path traversal and XSS in Include directive

Q: Is there a fix for CVE-2026-115355?

Yes. mistune (PyPI): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115355 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-115355?

Check whether you run Lepture Mistune or mistune (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115355 · Severity: high · CVSS 7.5 · Published 2026-10-22

Mistune is a markdown parser library used in web applications. The Include directive in Mistune before version 3.3.0 allows attackers to read arbitrary files from the server by using path traversal sequences (../), and to inject malicious scripts that execute in users' browsers even when output escaping is enabled. An attacker could exploit this to steal sensitive data or compromise user accounts.

Technologies: Lepture Mistune, mistune (PyPI). Vendors: Lepture, PyPI.

Quick answers

Is CVE-2026-115355 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115355 being exploited in the wild.
How severe is CVE-2026-115355?: High severity, with a CVSS score of 7.5, published 22 October 2026.
Which products and versions are affected?: Lepture Mistune before 3.3.0; mistune (PyPI) <= 3.2.0, ECOSYSTEM:introduced=0,fixed=3.3.0.
Is there a fix for CVE-2026-115355?: Yes. mistune (PyPI): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115355 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115355?: Check whether you run Lepture Mistune or mistune (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mistune (PyPI): upgrade to 3.3.0 or later
```
pip install "mistune>=3.3.0"
```

Technical details

The Include directive in src/mistune/directives/include.py fails to validate that resolved file paths remain within the intended source directory, enabling path traversal attacks via ../ sequences. Additionally, error messages and included file contents are rendered without HTML escaping in the render_html_include() and block_error() functions, allowing XSS injection even when escape=True is set. The Include plugin must be explicitly enabled, meaning applications using the standard Mistune parser without this plugin are unaffected.

Affected products

lepture Mistune before 3.3.0

Identifiers

CVE-2026-115355
GHSA-h7ww-273w-6cm8

Timeline

2026-06-21: disclosed: GitHub security advisory GHSA-h7ww-273w-6cm8 published
2026-10-22: advisory: CVE-2026-115355 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.