diff --git a/Misc/NEWS b/Misc/NEWS
index 87eabd4..6bf1301 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -147,6 +147,9 @@
 Library
 -------
 
+- Bug #1100201: Cross-site scripting was possible on BaseHTTPServer via
+  error messages.
+
 - Bug #1108948: Cookie.py produced invalid JavaScript code.
 
 - The tokenize module now detects and reports indentation errors.