PT-2026-121530
CVE-2026-115350
·
تاريخ النشر
2026-10-22
·
تاريخ التحديث
2026-10-22
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path traversal, to execute stored scripts when escape=False is set.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾