CVE-2017-16876: XSS
Published Dec 29, 2017
·Updated
Cross-site scripting (XSS) vulnerability in the keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
Affected Software
3 affected componentsFixes available
pip/mistune<0.8.1
0.8.1
Mistune Project Mistune<0.8.1
Fedoraproject Fedora=26
Remediation
Event History
Dec 29, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Jan 4, 2019
Advisory Published
via GitHub·05:47 PM
Frequently Asked Questions
1
What is the severity of CVE-2017-16876?
CVE-2017-16876 is categorized as a medium severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2017-16876?
To fix CVE-2017-16876, upgrade to Mistune version 0.8.1 or later.
3
What kind of attacks can CVE-2017-16876 enable?
CVE-2017-16876 can enable remote attackers to inject arbitrary web scripts or HTML into affected applications.
4
Which versions of Mistune are affected by CVE-2017-16876?
Mistune versions prior to 0.8.1 are affected by CVE-2017-16876.
5
What is the context of the XSS vulnerability in CVE-2017-16876?
CVE-2017-16876 arises from a failure to properly escape the 'key' argument in the _keyify function in mistune.py.