{"schema_version":1,"title":"Lepture Mistune vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 10 vulnerabilities in Lepture Mistune: 0 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, Mistune path traversal and XSS in Include directive, was published on 22 October 2026. 10 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/lepture-mistune","json_url":"https://junglewise.ai/threats/technologies/lepture-mistune.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/lepture-mistune","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":7,"all_time":10,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":10,"last_90_days":10,"last_365_days":10},"latest":[{"cvss":7.5,"slug":"duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187","title":"Mistune path traversal and XSS in Include directive","severity":"high","exploited":false,"published_at":"2026-10-22T21:32:36+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187"},{"cve":"CVE-2026-115355","cvss":7.5,"epss":0.0039,"slug":"cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in","title":"Mistune path traversal and XSS in Include directive","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:41.52+00:00","url":"https://junglewise.ai/threats/cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in"},{"cve":"CVE-2026-115354","cvss":6.5,"slug":"cve-2026-115354-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in","title":"Mistune path traversal in Include directive","severity":"medium","exploited":false,"published_at":"2026-10-22T19:17:41.373+00:00","url":"https://junglewise.ai/threats/cve-2026-115354-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in"},{"cve":"CVE-2026-115353","cvss":8.6,"slug":"cve-2026-115353-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in","title":"Mistune path traversal in RST include directive","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:41.227+00:00","url":"https://junglewise.ai/threats/cve-2026-115353-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in"},{"cve":"CVE-2026-115352","cvss":7.5,"slug":"cve-2026-115352-mistune-before-3-3-0-contains-an-algorithmic-complexity","title":"Mistune algorithmic complexity DoS in inline link parser","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:41.077+00:00","url":"https://junglewise.ai/threats/cve-2026-115352-mistune-before-3-3-0-contains-an-algorithmic-complexity"},{"cve":"CVE-2026-115351","cvss":4.7,"slug":"cve-2026-115351-mistune-from-3-2-1-before-3-3-0-contains-a-css-injection","title":"Mistune CSS injection in figure directive","severity":"medium","exploited":false,"published_at":"2026-10-22T19:17:40.92+00:00","url":"https://junglewise.ai/threats/cve-2026-115351-mistune-from-3-2-1-before-3-3-0-contains-a-css-injection"},{"cve":"CVE-2026-115350","cvss":6.1,"slug":"cve-2026-115350-mistune-before-3-3-0-contains-a-cross-site-scripting","title":"Mistune cross-site scripting in Include directive for HTML files","severity":"medium","exploited":false,"published_at":"2026-10-22T19:17:40.767+00:00","url":"https://junglewise.ai/threats/cve-2026-115350-mistune-before-3-3-0-contains-a-cross-site-scripting"},{"cve":"CVE-2026-115349","cvss":7.5,"slug":"cve-2026-115349-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic","title":"Mistune ReDoS in parse_link_text function","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:40.597+00:00","url":"https://junglewise.ai/threats/cve-2026-115349-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic"},{"cve":"CVE-2026-115348","cvss":7.5,"slug":"cve-2026-115348-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic","title":"Mistune algorithmic complexity DoS in inline link parser","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:40.43+00:00","url":"https://junglewise.ai/threats/cve-2026-115348-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic"},{"cve":"CVE-2026-115347","cvss":7.5,"slug":"cve-2026-115347-mistune-before-3-3-0-contains-an-inefficient-algorithmic","title":"Mistune parse_link_text quadratic denial of service","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:40.267+00:00","url":"https://junglewise.ai/threats/cve-2026-115347-mistune-before-3-3-0-contains-an-inefficient-algorithmic"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":10},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Lepture Mistune","slug":"lepture-mistune","vendor":{"hub":true,"name":"Lepture","slug":"lepture","url":"https://junglewise.ai/threats/vendors/lepture"},"aliases":[],"category":"library","description":"Python Markdown parser library that converts Markdown text to HTML.","url":"https://junglewise.ai/threats/technologies/lepture-mistune"},"most_severe":[{"cve":"CVE-2026-115353","cvss":8.6,"slug":"cve-2026-115353-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in","title":"Mistune path traversal in RST include directive","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:41.227+00:00","url":"https://junglewise.ai/threats/cve-2026-115353-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in"},{"cve":"CVE-2026-115355","cvss":7.5,"epss":0.0039,"slug":"cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in","title":"Mistune path traversal and XSS in Include directive","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:41.52+00:00","url":"https://junglewise.ai/threats/cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in"},{"cvss":7.5,"slug":"duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187","title":"Mistune path traversal and XSS in Include directive","severity":"high","exploited":false,"published_at":"2026-10-22T21:32:36+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187"},{"cve":"CVE-2026-115352","cvss":7.5,"slug":"cve-2026-115352-mistune-before-3-3-0-contains-an-algorithmic-complexity","title":"Mistune algorithmic complexity DoS in inline link parser","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:41.077+00:00","url":"https://junglewise.ai/threats/cve-2026-115352-mistune-before-3-3-0-contains-an-algorithmic-complexity"},{"cve":"CVE-2026-115349","cvss":7.5,"slug":"cve-2026-115349-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic","title":"Mistune ReDoS in parse_link_text function","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:40.597+00:00","url":"https://junglewise.ai/threats/cve-2026-115349-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic"},{"cve":"CVE-2026-115348","cvss":7.5,"slug":"cve-2026-115348-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic","title":"Mistune algorithmic complexity DoS in inline link parser","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:40.43+00:00","url":"https://junglewise.ai/threats/cve-2026-115348-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic"},{"cve":"CVE-2026-115347","cvss":7.5,"slug":"cve-2026-115347-mistune-before-3-3-0-contains-an-inefficient-algorithmic","title":"Mistune parse_link_text quadratic denial of service","severity":"high","exploited":false,"published_at":"2026-10-22T19:17:40.267+00:00","url":"https://junglewise.ai/threats/cve-2026-115347-mistune-before-3-3-0-contains-an-inefficient-algorithmic"},{"cve":"CVE-2026-115354","cvss":6.5,"slug":"cve-2026-115354-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in","title":"Mistune path traversal in Include directive","severity":"medium","exploited":false,"published_at":"2026-10-22T19:17:41.373+00:00","url":"https://junglewise.ai/threats/cve-2026-115354-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in"},{"cve":"CVE-2026-115350","cvss":6.1,"slug":"cve-2026-115350-mistune-before-3-3-0-contains-a-cross-site-scripting","title":"Mistune cross-site scripting in Include directive for HTML files","severity":"medium","exploited":false,"published_at":"2026-10-22T19:17:40.767+00:00","url":"https://junglewise.ai/threats/cve-2026-115350-mistune-before-3-3-0-contains-a-cross-site-scripting"},{"cve":"CVE-2026-115351","cvss":4.7,"slug":"cve-2026-115351-mistune-from-3-2-1-before-3-3-0-contains-a-css-injection","title":"Mistune CSS injection in figure directive","severity":"medium","exploited":false,"published_at":"2026-10-22T19:17:40.92+00:00","url":"https://junglewise.ai/threats/cve-2026-115351-mistune-from-3-2-1-before-3-3-0-contains-a-css-injection"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}