CVE catalog

CVE-2017-16876

mistune: CVE-2017-16876

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.23% · Oct 25, 2026

Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmistunesid3.4.0-1fixed
Debianmistuneforky3.1.4-1fixed
Debianmistunetrixie3.1.3-1fixed
Debianmistunebookworm2.0.4-1fixed
Ubuntumistune16.040.6-2vulnerable
Ubuntumistune16.040.7.1-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmistunesourcesid0.8.1-1not yet assignedNot reportedNot reported
Debianmistunesourceforky0.8.1-1not yet assignedNot reportedNot reported
Debianmistunesourcetrixie0.8.1-1not yet assignedNot reportedNot reported
Debianmistunesourcebookworm0.8.1-1not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-mistune]Fixed

    Source package: [mistune]

    Details (2)

    • 2.0.4-1 · all · bookworm

      Fixed · Fixed: 0.8.1-1

      dsa · mistune · debian · bookworm; dsa · mistune · debian · 12

    • 2.0.4-1 · all · bookworm

      Fixed · Fixed: 0.8.1-1

      dsa · mistune · debian · bookworm; dsa · mistune · debian · 12

[Debian 13 (Trixie)]

  • [python3-mistune]Fixed

    Source package: [mistune]

    Details (2)

    • 3.1.3-1 · all · trixie

      Fixed · Fixed: 0.8.1-1

      dsa · mistune · debian · 13

    • 3.1.3-1 · all · trixie

      Fixed · Fixed: 0.8.1-1

      dsa · mistune · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]