CVE-2026-115353

{
  "etk_id": "ETK-2026-2494",
  "cve_id": "CVE-2026-115353",
  "display_id": "CVE-2026-115353",
  "ghsa_id": "GHSA-9jjx-3hq3-hx4j",
  "euvd_id": "EUVD-2026-108422",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in Mistune RST include handling",
  "summary": "Mistune versions earlier than 3.3.0 are affected by path traversal in RST include processing. An attacker who can supply content for rendering may cause the renderer to incorporate readable local files when include directives are processed.",
  "mitigation": "Upgrade mistune to version 3.3.0 or later. Until upgrading, do not render untrusted content with RST include directives enabled.",
  "vendor": "lepture",
  "product": "mistune",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 3.2.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "3.3.0"
      ],
      "package_name": "mistune",
      "purl": "pkg:pypi/mistune"
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 9.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 7.712077533333333,
  "t0_at": "2026-10-22T19:13:30.422000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-22T19:13:30.422000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T19:13:30.422000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115353"
    }
  }
}