CVE-2017-16876
mistune Cross-site scripting (XSS) vulnerability
CVE-2017-16876 is a medium vulnerability (CVSS 6.1) in Mistune Project Mistune, published December 29, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.23%, the 82nd percentile. Fixed in mistune 0.8.1.
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
- Record
CVE-2017-16876- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
- Record
CVE-2017-16876- Updated
- 2026-11-02
EUVDEUVD-2017-0074 No score
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
- Record
EUVD-2017-0074- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-98gj-wwxm-cj3h
mistune Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
- Record
GHSA-98gj-wwxm-cj3h- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
- Record
CVE-2017-16876- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-16876
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
- Record
DEBIAN-CVE-2017-16876- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-98gj-wwxm-cj3h
mistune Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
- Record
GHSA-98gj-wwxm-cj3h- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-16876
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
- Record
UBUNTU-CVE-2017-16876- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2018-0066 No score
Updated python-mistune packages fix security vulnerabilities
mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions (CVE-2017-15612).
A cross-site-scripting vulnerability was found in python-mistune (CVE-2017-16876).
- Record
MGASA-2018-0066- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11239-1 No score
python36-mistune-0.8.4-3.5 on GA media
These are all security issues fixed in the python36-mistune-0.8.4-3.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11239-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13453-1 No score
python310-mistune2-2.0.5-1.1 on GA media
These are all security issues fixed in the python310-mistune2-2.0.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13453-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14148-1 No score
python310-mistune-3.0.2-2.5 on GA media
These are all security issues fixed in the python310-mistune-3.0.2-2.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14148-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11585-1 No score
python313-mistune-3.3.4-1.1 on GA media
These are all security issues fixed in the python313-mistune-3.3.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11585-1- Updated
- 2026-11-02
OSVPYSEC-2017-18 No score
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
- Record
PYSEC-2017-18- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mistunePyPI |
before 0.8.1 | 0.8.1 |
mistuneDebian:12 |
before 0.8.1-1 | 0.8.1-1 |
mistuneDebian:13 |
before 0.8.1-1 | 0.8.1-1 |
mistuneDebian:14 |
before 0.8.1-1 | 0.8.1-1 |
mistunePyPI |
before 0.8.1, plus listed versions 0.1.00.2.00.3.00.3.10.4 Show 10 moreShow less0.4.10.50.5.10.60.70.7.10.7.20.7.30.7.40.8 |
0.8.1 |
python-mistuneMageia:6 |
before 0.7.2-1.1.mga6 | 0.7.2-1.1.mga6 |
mistuneUbuntu:16.04:LTS |
All versions, plus listed versions 0.6-20.7.1-1 |
None known |
python-mistuneopenSUSE:Tumbleweed |
before 3.0.2-2.5 | 3.0.2-2.5 |
python-mistuneopenSUSE:Tumbleweed |
before 3.3.4-1.1 | 3.3.4-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/lepture/mistune/blob/master/CHANGES.rst
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUR3GMHQBMA3UC4PFMCK6GCLOQC4LQQC
bugzilla.redhat.com/show_bug.cgi?id=1524596
nvd.nist.gov/vuln/detail/CVE-2017-16876
Show 12 moreShow less
security-tracker.debian.org/tracker/CVE-2017-16876
advisories.mageia.org/MGASA-2018-0066.html
bugs.mageia.org/show_bug.cgi?id=22276
ubuntu.com/security/CVE-2017-16876
cve.org/CVERecord?id=CVE-2017-16876
suse.com/security/cve/CVE-2017-15612