CVE-2026-115350 Mistune before 3.3.0 Stored XSS via Include Directive HTML Files
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-115350?
CVE-2026-115350 is a medium-severity vulnerability in lepture mistune, published on 22 Oct 2026.
Official description
Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path traversal, to execute stored scripts when escape=False is set.
Weakness: CWE-79
Which versions are affected by CVE-2026-115350?
How do I fix CVE-2026-115350?
No fix has been published for CVE-2026-115350 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-115350 being exploited?
There is no known exploitation of CVE-2026-115350 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-115350, GHSA-96vr-jm8v-g22j, GHSA-pw44-j765-r9gj, UBUNTU-CVE-2026-115350.