Description
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
lepture mistune
Default version status: unaffected
0 to < 3.3.0affected3.3.0unaffected
pkg:pypi/mistune