CVE-2017-16876: PYSEC-2017-18 - Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arb

CVE-2017-16876 · Severity: low · CVSS 3.1 · Published 2017-12-29

Technologies: mistune (PyPI). Vendors: PyPI.

Executive brief

Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.

Affected products

PyPI mistune

Related threats

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tok
lepture Mistune predictable ID generation in TOC plugin
lepture mistune XSS via incomplete URL scheme filtering in HTML renderer
lepture Mistune denial of service in reference-link parsing
lepture Mistune uncontrolled recursion in Include directive