{"action":"Upgrade mistune to 0.8.1 or later.","affected":[{"fixed":"0.8.1","introduced":"0"}],"component":"mistune","cve_ids":["CVE-2017-16876"],"ecosystem":"PyPI","epss":0.02235,"exploited":false,"fixed_versions":["0.8.1"],"ghsa_id":"GHSA-98gj-wwxm-cj3h","id":"tcs_01M5KG74WHGW0H5GFZF190FTS9","modified_at":"2023-11-08T03:59:13.855357Z","published_at":"2017-12-29T15:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-18","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NUR3GMHQBMA3UC4PFMCK6GCLOQC4LQQC/","https://github.com/lepture/mistune/commit/5f06d724bc05580e7f203db2d4a4905fc1127f98","https://github.com/lepture/mistune/blob/master/CHANGES.rst","https://bugzilla.redhat.com/show_bug.cgi?id=1524596","https://github.com/advisories/GHSA-98gj-wwxm-cj3h"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2017-18","url":"https://osv.dev/vulnerability/PYSEC-2017-18"}],"summary":"Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape th"}