CVE-2017-15612

Advisory

Mistune.py in mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions. See CVE-2017-15612.
https://github.com/lepture/mistune/pull/140

Affected package

Affected versions

Fixed versions

Vulnerability changelog

~~~~~~~~~~~

Released on Oct. 26, 2017

* Remove non breaking spaces preprocessing
* Remove rev and rel attribute for footnotes
* Fix bypassing XSS vulnerability by junorouse

This version is strongly recommended, since it fixed
a security issue.

Resources

• https://pypi.org/project/mistune
• https://pyup.io/changelogs/mistune/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15612
• https://github.com/lepture/mistune/pull/140