mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15612.json"