CVE-2017-15612: XSS
Published Oct 19, 2017
·Updated
mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions.
Affected Software
2 affected componentsFixes available
pip/mistune>=0<0.8
0.8
Mistune Project Mistune=0.7.4
Remediation
Patch Available
Event History
Oct 19, 2017
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
May 17, 2022
Advisory Published
12:26 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-15612?
CVE-2017-15612 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.
2
How do I fix CVE-2017-15612?
To fix CVE-2017-15612, upgrade the mistune package to version 0.8 or higher.
3
Which versions of mistune are affected by CVE-2017-15612?
CVE-2017-15612 affects mistune version 0.7.4.
4
What types of attacks can CVE-2017-15612 lead to?
CVE-2017-15612 can lead to cross-site scripting (XSS) attacks through crafted inputs.
5
Is CVE-2017-15612 related to email addresses or newlines?
Yes, CVE-2017-15612 is related to unexpected newlines and crafted email addresses in the mistune package.