{"schema_version":"1.7.2","id":"OESA-2026-4793","modified":"2026-11-11T12:26:13Z","published":"2026-11-11T12:26:13Z","upstream":["CVE-2026-115350","CVE-2026-115353","CVE-2026-115354","CVE-2026-115355"],"summary":"python-mistune security update","details":"The python-mistune package is a fast yet powerful Python Markdown parser with renderers and plugins, compatible with sane CommonMark rules.\r\n\r\nSecurity Fix(es):\n\nMistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path traversal, to execute stored scripts when escape=False is set.(CVE-2026-115350)\n\nMistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.(CVE-2026-115353)\n\nMistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.(CVE-2026-115354)\n\nMistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.(CVE-2026-115355)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"python-mistune","purl":"pkg:rpm/openEuler/python-mistune&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-4.oe2403sp1"}]}],"ecosystem_specific":{"noarch":["python3-mistune-2.0.4-4.oe2403sp1.noarch.rpm","python3-mistune-v1-2.0.4-4.oe2403sp1.noarch.rpm"],"src":["python-mistune-2.0.4-4.oe2403sp1.src.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4793"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115350"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115353"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115354"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115355"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}],"database_specific":{"severity":"High"}}