CVE-2017-15612: mistune_project mistune
Vulnerability summary
CVE-2017-15612 is a medium (CVSS 6.1) vulnerability in mistune_project mistune. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 60.6% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 19-10-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · PypiEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.93%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.92% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundMistune
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- mistune< 0.8-1
Mistune_project1 product
- mistune0.7.4
PyPI1 product
- mistune< 0.8
Ubuntu1 product
- mistuneAll versions (No fix recorded)
4 vendors · 4 products
References
9 links- github.com/lepture/mistune/pull/140X Refsource CONFIRMExploitIssue TrackingPatchThird Party AdvisoryWEBREPORT
- github.com/lepture/mistunePACKAGE
