{"id":"CVE-2017-16876","title":"Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arb","published":"2017-12-29T11:29:00.610Z","updated":"2026-06-16T21:10:04.403Z","severity":"medium","cvssScore":6.1,"epss":0.02235,"epssPct":0.83047,"kev":false,"maturity":"none","actionScore":25,"primaryVendor":"mistune project","primaryProduct":"mistune","cweId":"CWE-79","fixAvailable":true,"tags":["pre-auth","xss","remote"],"epssDelta7":0.0004,"summary":"Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the \"key\" argument.","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssVersion":"3.0","cvssSource":"nvd-primary","cweName":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-05T20:35:21.320Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:50:11.468Z"},"cvssCna":null,"hasPatchRef":true,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"mistune project","product":"mistune","cpe":"cpe:2.3:a:mistune_project:mistune"},{"vendor":"fedoraproject","product":"fedora","cpe":"cpe:2.3:o:fedoraproject:fedora"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1524596","tags":"Issue Tracking,Third Party Advisory,VDB Entry"},{"url":"https://github.com/lepture/mistune/blob/master/CHANGES.rst","tags":"Release Notes,Third Party Advisory"},{"url":"https://github.com/lepture/mistune/commit/5f06d724bc05580e7f203db2d4a4905fc1127f98","tags":"Patch,Third Party Advisory"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUR3GMHQBMA3UC4PFMCK6GCLOQC4LQQC/","tags":null}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"fedoraproject","product":"fedora","version":"26","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"mistune project","product":"mistune","version":"*","vsi":null,"vse":null,"vei":null,"vee":"0.8.1"}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}