CVE-2026-115354 lepture CVE debrief

Who should care

Defenders responsible for systems using Mistune, particularly those allowing user-submitted Markdown content, should assess exposure and prioritize patching or upgrading to prevent potential file disclosure.

Why it matters

CVE-2026-115354 is a high-severity vulnerability in Mistune that allows attackers to read local files via the Include directive, potentially leading to unauthorized file disclosure and injection of malicious content. Defenders should prioritize patching or upgrading to Mistune version 3.3.0 or later.

• Potential unauthorized file disclosure
• Possible injection of unescaped HTML or script content
• Need for verification of affected versions and remediation
• Importance of monitoring for suspicious file access activity

Technical summary

The vulnerability exists in the Include directive of Mistune, a Python Markdown parser, allowing attackers to read local files by supplying relative or absolute include paths. This issue is fixed in Mistune version 3.3.0. The vulnerability allows for potential unauthorized file disclosure and injection of unescaped HTML or script content into rendered output. Defenders should prioritize patching or upgrading to prevent potential file disclosure and review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Defenders should prioritize patching or upgrading to Mistune version 3.3.0 or later to prevent potential file disclosure.

Recommended defensive actions

• Upgrade to Mistune version 3.3.0 or later
• Review and restrict Markdown content to prevent malicious submissions
• Monitor for suspicious activity related to file access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Mistune versions before 3.3.0 and the potential for file disclosure via the Include directive. Defenders should verify affected versions, review Markdown content for potential malicious submissions, and monitor for suspicious file access activity. Evidence is limited to publicly available information and may not reflect the full scope of affected systems or potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.