# Lepture Mistune vulnerabilities Source: https://junglewise.ai/threats/technologies/lepture-mistune Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/lepture-mistune.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 10 vulnerabilities in Lepture Mistune: 0 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, Mistune path traversal and XSS in Include directive, was published on 22 October 2026. 10 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 10 - Last 90 days: 10 - All time: 10 (0 critical, 0 exploited in the wild) ## About Lepture Mistune Python Markdown parser library that converts Markdown text to HTML. ## Latest Lepture Mistune vulnerabilities - [Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115355: Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115354: Mistune path traversal in Include directive](https://junglewise.ai/threats/cve-2026-115354-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (medium, CVSS 6.5, published 22 Oct 2026) - [CVE-2026-115353: Mistune path traversal in RST include directive](https://junglewise.ai/threats/cve-2026-115353-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (high, CVSS 8.6, published 22 Oct 2026) - [CVE-2026-115352: Mistune algorithmic complexity DoS in inline link parser](https://junglewise.ai/threats/cve-2026-115352-mistune-before-3-3-0-contains-an-algorithmic-complexity) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115351: Mistune CSS injection in figure directive](https://junglewise.ai/threats/cve-2026-115351-mistune-from-3-2-1-before-3-3-0-contains-a-css-injection) (medium, CVSS 4.7, published 22 Oct 2026) - [CVE-2026-115350: Mistune cross-site scripting in Include directive for HTML files](https://junglewise.ai/threats/cve-2026-115350-mistune-before-3-3-0-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 22 Oct 2026) - [CVE-2026-115349: Mistune ReDoS in parse_link_text function](https://junglewise.ai/threats/cve-2026-115349-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115348: Mistune algorithmic complexity DoS in inline link parser](https://junglewise.ai/threats/cve-2026-115348-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115347: Mistune parse_link_text quadratic denial of service](https://junglewise.ai/threats/cve-2026-115347-mistune-before-3-3-0-contains-an-inefficient-algorithmic) (high, CVSS 7.5, published 22 Oct 2026) ## Most severe Lepture Mistune vulnerabilities - [CVE-2026-115353: Mistune path traversal in RST include directive](https://junglewise.ai/threats/cve-2026-115353-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (high, CVSS 8.6, published 22 Oct 2026) - [CVE-2026-115355: Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/cve-2026-115355-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (high, CVSS 7.5, published 22 Oct 2026) - [Mistune path traversal and XSS in Include directive](https://junglewise.ai/threats/duplicate-advisory-mistune-path-traversal-and-xss-in-include-directive-bf25c187) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115352: Mistune algorithmic complexity DoS in inline link parser](https://junglewise.ai/threats/cve-2026-115352-mistune-before-3-3-0-contains-an-algorithmic-complexity) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115349: Mistune ReDoS in parse_link_text function](https://junglewise.ai/threats/cve-2026-115349-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115348: Mistune algorithmic complexity DoS in inline link parser](https://junglewise.ai/threats/cve-2026-115348-mistune-from-3-0-0-before-3-3-0-contains-an-algorithmic) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115347: Mistune parse_link_text quadratic denial of service](https://junglewise.ai/threats/cve-2026-115347-mistune-before-3-3-0-contains-an-inefficient-algorithmic) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-115354: Mistune path traversal in Include directive](https://junglewise.ai/threats/cve-2026-115354-mistune-before-3-3-0-contains-a-path-traversal-vulnerability-in) (medium, CVSS 6.5, published 22 Oct 2026) - [CVE-2026-115350: Mistune cross-site scripting in Include directive for HTML files](https://junglewise.ai/threats/cve-2026-115350-mistune-before-3-3-0-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 22 Oct 2026) - [CVE-2026-115351: Mistune CSS injection in figure directive](https://junglewise.ai/threats/cve-2026-115351-mistune-from-3-2-1-before-3-3-0-contains-a-css-injection) (medium, CVSS 4.7, published 22 Oct 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 10 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Lepture Mistune vulnerabilities", https://junglewise.ai/threats/technologies/lepture-mistune, 9 November 2026.