CVE-2017-15612: Cross-site Scripting in Mistune
Summary
CVE-2017-15612: Cross-site Scripting in Mistune. Affects mistune versions < 0.8. Fixed in 0.8. How to fix ↓
Also tracked for
- mistune · Debian:11
The same CVE-2017-15612 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mistune is a Python package available on PyPI that provides a Markdown parser. It is commonly used to convert Markdown text into HTML. The package is widely adopted and utilized in various projects. However, Mistune version 0.7.4 is vulnerable to a cross-site scripting (XSS) attack. This vulnerability allows an attacker to inject malicious code into the generated HTML output, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The vulnerability in Mistune 0.7.4 arises from the mishandling of unexpected newlines or crafted email addresses. Specifically, the 'escape' and 'autolink' functions in mistune.py can be exploited to execute arbitrary JavaScript code. An attacker can insert a newline followed by 'java\nscript:' or provide a specially crafted email address to trigger the XSS vulnerability. This can result in the execution of malicious code within the context of the user's browser, compromising the integrity and confidentiality of user data.
How To Fix
Latest published version: 3.4.0 as of 22 Oct 2026
pip install --upgrade "mistune==3.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8
This is the first release that contains the fix.
pip install --upgrade "mistune==0.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize and validate user-generated content before passing it to the Mistune parser. This involves implementing proper input validation and escaping techniques to prevent the injection of malicious code. Here's an example of how to sanitize user input in Python:
import mistune
def sanitize_input(input_text):
# Perform input sanitization and validation
sanitized_text = ... # Sanitization logic
return sanitized_text
# Usage example
user_input = get_user_input()
sanitized_input = sanitize_input(user_input)
html_output = mistune.markdown(sanitized_input)
It is important to note that this workaround is not a comprehensive solution and should be considered temporary until the package is updated to a fixed version.
Conclusion
In conclusion, Mistune version 0.7.4 is vulnerable to a cross-site scripting (XSS) attack. This vulnerability can be exploited through unexpected newlines or crafted email addresses, allowing an attacker to execute arbitrary JavaScript code within the user's browser. To mitigate this risk, it is recommended to upgrade to Mistune version 0.8 or later. Additionally, developers can implement temporary input sanitization and validation measures until the package is updated. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mistune →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can lead to various malicious activities, including unauthorized access, data theft, and the manipulation of user interactions.
To determine if your application is affected, you can use Vulert's vulnerability monitoring service. Vulert analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities, including this specific issue. You can check your application's vulnerability status at Vulert Scanner without any signup.
While specific exploits targeting this vulnerability may exist, they have not been disclosed in the public domain at the time of this report. However, it is crucial to address the vulnerability promptly to mitigate the risk of potential exploitation.
Yes, the Mistune maintainers have acknowledged and fixed this vulnerability in version 0.8. It is recommended to upgrade to the latest version to ensure the security of your application.
The CVSS score of this vulnerability is 6.1, indicating a moderate level of severity. It is important to address this vulnerability promptly to mitigate potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for mistune.
