# Mistune path traversal and XSS in Include directive

Source: https://junglewise.ai/threats/duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-10-22

Mistune is a Python library that converts markdown text into HTML. The Include directive plugin does not properly validate file paths, allowing attackers to read arbitrary files from the server using directory traversal sequences like ../. Additionally, error messages and included content are rendered without escaping, enabling script injection attacks even when HTML escaping is enabled.

Technologies: [Lepture Mistune](https://junglewise.ai/threats/technologies/lepture-mistune), [mistune (PyPI)](https://junglewise.ai/threats/technologies/mistune). Vendors: [Lepture](https://junglewise.ai/threats/vendors/lepture), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 22 October 2026.

**Which products and versions are affected?** Lepture Mistune <= 3.2.0; mistune (PyPI) < 3.3.0, ECOSYSTEM:introduced=0.

**Is there a fix for This vulnerability?** Yes: fixed in 3.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Lepture Mistune or mistune (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.3.0

## Technical details

Path traversal in the Include directive's file resolution (lines 27-31 in src/mistune/directives/include.py) fails to restrict resolved paths within the source directory, permitting ../ sequences to escape the intended directory. HTML error messages in block_error() and rendered content in render_html_include() are not escaped before output, enabling XSS injection. The Include plugin must be explicitly enabled, and exploitation requires network access to a service using the vulnerable library.

## Affected products

- lepture Mistune <= 3.2.0

## Timeline

- 2026-06-21: disclosed
- 2026-06-21: patched: Patched version 3.3.0 released
- 2026-10-22: advisory

## References

- [https://github.com/lepture/mistune/security/advisories/GHSA-h7ww-273w-6cm8](https://github.com/lepture/mistune/security/advisories/GHSA-h7ww-273w-6cm8)

## Related threats

- [Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in)
- [Mistune path traversal in Include directive](https://junglewise.ai/threats/cve-2026-115354-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in)
- [Mistune path traversal in RST include directive](https://junglewise.ai/threats/cve-2026-115353-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in)
- [Mistune algorithmic complexity DoS in inline link parser](https://junglewise.ai/threats/cve-2026-115352-mistune-before-3-3-0-contains-an-algorithmic-complexity)
- [Mistune CSS injection in figure directive](https://junglewise.ai/threats/cve-2026-115351-mistune-from-3-2-1-before-3-3-0-contains-a-css-injection)