AIKIDO-2026-387556

TL;DR

The .. literalinclude:: directive in rich-rst reads the file path given in its argument without checking that the path stays inside the source document's directory. Absolute paths and ../ parent directory segments both resolve, so rendering reStructuredText from an untrusted source discloses any file the rendering process can read, such as /etc/passwd. The fix disables directives that read other files by default and, when re-enabled through allow_file_access, resolves symlinks and rejects paths outside the source directory.