python-mistune before version 2.0.4-4.oe2403sp1 contains multiple vulnerabilities including cross-site scripting (XSS) and path traversal in its Include and RST include directives. These flaws allow attackers to read arbitrary local files and inject malicious HTML or scripts into rendered Markdown output. The vulnerabilities are fixed in version 2.0.4-4.oe2403sp1.