{"id":"CVE-2017-15612","title":"mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\\nscript:) or a crafted email address, related to the escap","published":"2017-10-19T04:29:00.920Z","updated":"2026-06-16T21:07:57.677Z","severity":"medium","cvssScore":6.1,"epss":0.00931,"epssPct":0.61098,"kev":false,"maturity":"none","actionScore":24,"primaryVendor":"mistune project","primaryProduct":"mistune","cweId":"CWE-79","fixAvailable":true,"tags":["pre-auth","xss","remote"],"epssDelta7":0.0001,"summary":"mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\\nscript:) or a crafted email address, related to the escape and autolink functions.","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssVersion":"3.0","cvssSource":"nvd-primary","cweName":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-05T19:57:27.514Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:50:03.678Z"},"cvssCna":null,"hasPatchRef":true,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"mistune project","product":"mistune","cpe":"cpe:2.3:a:mistune_project:mistune"}],"references":[],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"mistune project","product":"mistune","version":"0.7.4","vsi":null,"vse":null,"vei":null,"vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}