CyberRota Analysis
AI-GeneratedMistune, a Python Markdown parser, is vulnerable due to its Include.parse() function, which improperly handles user-supplied include paths, potentially allowing unauthorized access to files outside the intended markdown directory. This could lead to information disclosure when processing markdown files. Developers and organizations using versions prior to 3.3.0 should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)