CVE-2017-16876: Cross-site Scripting (XSS) Vulnerability in mistune
Summary
CVE-2017-16876: Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument. Affects mistune across 2 version ranges.
< 0.8.1
< 5f06d724bc05580e7f203db2d4a4905fc1127f98
Fixed in 5f06d724bc05580e7f203db2d4a4905fc1127f98. How to fix ↓
Also tracked for
- mistune · Debian:11
The same CVE-2017-16876 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mistune is a Python package available on PyPI that provides a fast and full-featured Markdown parser. It is commonly used in web applications to convert Markdown text into HTML for rendering. The vulnerability identified as CVE-2017-16876 is a cross-site scripting (XSS) vulnerability that exists in the _keyify function within the mistune.py module. This function fails to properly escape the 'key' argument, allowing remote attackers to inject arbitrary web script or HTML code.
Vulnerability Detail
The vulnerability arises from the lack of proper input sanitization in the _keyify function of mistune. By exploiting this flaw, an attacker can inject malicious code into the generated HTML output, which may lead to various security issues. This includes the potential for session hijacking, defacement of web pages, or the theft of sensitive user information. The vulnerability affects all versions of mistune prior to 0.8.1.
How To Fix
Latest published version: 3.4.0 as of 22 Oct 2026
pip install --upgrade "mistune==3.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5f06d724bc05580e7f203db2d4a4905fc1127f98
This is the first release that contains the fix.
pip install --upgrade "mistune==5f06d724bc05580e7f203db2d4a4905fc1127f98"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually escape the 'key' argument before passing it to the _keyify function. This can be achieved by using appropriate HTML encoding or escaping functions provided by the programming language or framework being used. Here is an example in Python:
import mistune
key = '<script>alert("XSS")</script>' escaped_key = mistune.escape(key)
Pass escaped_key to _keyify function
Conclusion
The CVE-2017-16876 vulnerability in mistune exposes web applications to cross-site scripting attacks. It is crucial for developers to upgrade to mistune version 0.8.1 or later to mitigate this vulnerability. In the meantime, developers can apply the provided workaround to manually escape the 'key' argument. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mistune →
FAQ
The vulnerability allows attackers to inject arbitrary web script or HTML code, which can lead to various security issues such as session hijacking, defacement of web pages, or theft of sensitive user information.
All versions of mistune prior to 0.8.1 are affected by this vulnerability.
Yes, upgrading mistune to version 0.8.1 or later fixes this vulnerability.
Yes, developers can manually escape the 'key' argument before passing it to the _keyify function as a temporary workaround.
You can find more information about this vulnerability in the mistune advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/mistune/PYSEC-2017-18.yaml
Related vulnerabilities
Recent vulnerabilities recorded for mistune.
