CVE-2026-115353 lepture CVE debrief

Who should care

Defenders responsible for systems using Mistune, particularly those using versions before 3.3.0, should assess exposure and prioritize mitigation. This includes reviewing systems for potential exposure, monitoring for potential exploitation attempts, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-115353 is a critical path traversal vulnerability in Mistune before 3.3.0 that allows attackers to read arbitrary files via the RST include directive. Defenders should prioritize upgrading to version 3.3.0 or later and review systems for potential exposure. The vulnerability's critical severity and potential impact necessitate urgent attention.

• Potential unauthorized file access
• Possible exposure of sensitive information
• Need for urgent patching or mitigation
• Potential for exploitation in various deployment contexts

Technical summary

The vulnerability exists in the RST include directive of Mistune, allowing attackers to read arbitrary files by supplying relative or absolute paths. This can be exploited by submitting markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML. The vulnerability has a CVSS score of 9.2 and is considered critical. Defenders should prioritize upgrading to version 3.3.0 or later and review systems for potential exposure.

Defensive priority

Defenders should prioritize upgrading Mistune to version 3.3.0 or later to mitigate this vulnerability. Systems using affected versions of Mistune should be reviewed for potential exposure.

Recommended defensive actions

• Upgrade Mistune to version 3.3.0 or later
• Review systems using affected versions of Mistune for potential exposure
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its critical severity and potential impact. However, there is limited information on exploitation or affected systems. Defenders should verify potential exposure and review systems for affected versions of Mistune. The evidence is based on the CVE record and source item, which may have limitations in terms of detail and scope.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.