Cross-site scripting in pywb

2021-09-0217:16:18

Google

osv.dev

0.001 Low

EPSS

Percentile

29.3%

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.

CPENameOperatorVersion
pywbeq0.9.1
pywbeq0.10.9
pywbeq0.4.5
pywbeq0.10.2
pywbeq0.6.0
pywbeq0.10.0
pywbeq0.8.3
pywbeq2.3.3
pywbeq0.6.3
pywbeq2.4.2

Name	Operator	Version
pywb	eq	0.9.1
pywb	eq	0.10.9
pywb	eq	0.4.5
pywb	eq	0.10.2
pywb	eq	0.6.0
pywb	eq	0.10.0
pywb	eq	0.8.3
pywb	eq	2.3.3
pywb	eq	0.6.3
pywb	eq	2.4.2

Rows per page:

1-10 of 831

References

github.com/webrecorder/pywb

github.com/webrecorder/pywb/commit/f7bd84cdacdd665ff73ae8d09a202f60be2ebae9

github.com/webrecorder/pywb/compare/v-2.5.0...v-2.6.0

nvd.nist.gov/vuln/detail/CVE-2021-39286

0.001 Low

EPSS

Percentile

29.3%

Related for OSV:GHSA-947X-PV47-PP3Q