Description (CNA)
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| lepture / mistune | affected 0 before 3.3.0; unaffected 3.3.0 |
CWE
CWE-22