Threats tagged 'brew-buku-cve-2026-115355'

The Include directive in `src/mistune/directives/include.py` does not validate that the resolved file path stays within the source directory, allowing path traversal via `../` sequences to read arbitrary files. Additionally, error messages and included file contents are rendered without HTML escaping, leading to XSS even when `escape=True`. Affected functions: - Path resolution (lines 27-31) - `block_error()` in html.py (line 140) - `render_html_include()` (line 72) The Include plugin must be explicitly enabled via the plugins parameter.