python-mistune versions before 2.0.4-4.oe2403sp4 contain multiple vulnerabilities including cross-site scripting (XSS) and path traversal in the Include directive. These flaws allow attackers to read arbitrary local files and inject malicious HTML or scripts into rendered Markdown output. The issues are fixed in version 2.0.4-4.oe2403sp4.