Executive brief
mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions.
Affected products
- PyPI mistune
Junglewise Threat Intelligence
CVE-2017-15612: PYSEC-2017-80 - mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escap
CVE-2017-15612 · Severity: low · CVSS 3 · Published 2017-10-19
Technologies: mistune (PyPI). Vendors: PyPI.
Related threats
- Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tok
- lepture Mistune predictable ID generation in TOC plugin
- lepture mistune XSS via incomplete URL scheme filtering in HTML renderer
- lepture Mistune denial of service in reference-link parsing
- lepture Mistune uncontrolled recursion in Include directive