ByteOS Network

NVD Vulnerability Details :

CVE-2017-16876

Deferred

Source-cve@mitre.org

Published At-29 Dec, 2017 | 15:29

Updated At-20 Apr, 2025 | 01:37

Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

mistune_project>>mistune>>Versions before 0.8.1(exclusive)

cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*

Fedora Project

>>fedora>>26

cpe:2.3:o:fedoraproject:fedora:26:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1524596	cve@mitre.org	Issue Tracking Third Party Advisory VDB Entry
https://github.com/lepture/mistune/blob/master/CHANGES.rst	cve@mitre.org	Release Notes Third Party Advisory
https://github.com/lepture/mistune/commit/5f06d724bc05580e7f203db2d4a4905fc1127f98	cve@mitre.org	Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUR3GMHQBMA3UC4PFMCK6GCLOQC4LQQC/	cve@mitre.org	N/A
https://bugzilla.redhat.com/show_bug.cgi?id=1524596	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Third Party Advisory VDB Entry
https://github.com/lepture/mistune/blob/master/CHANGES.rst	af854a3a-2127-422b-91ae-364da2661108	Release Notes Third Party Advisory
https://github.com/lepture/mistune/commit/5f06d724bc05580e7f203db2d4a4905fc1127f98	af854a3a-2127-422b-91ae-364da2661108	Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUR3GMHQBMA3UC4PFMCK6GCLOQC4LQQC/	af854a3a-2127-422b-91ae-364da2661108	N/A

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History