What is GHSA-5c8p-qhch-qhx6?

GHSA-5c8p-qhch-qhx6 is a security advisory published by GitHub Security Advisories with Medium severity. Deluge Web-UI vulnerable to XSS through a crafted torrent file

Which CVE IDs does GHSA-5c8p-qhch-qhx6 cover?

GHSA-5c8p-qhch-qhx6 covers the following CVE IDs: CVE-2021-3427. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5c8p-qhch-qhx6?

GHSA-5c8p-qhch-qhx6 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-5c8p-qhch-qhx6?

GHSA-5c8p-qhch-qhx6 affects 1 product, including: pip/deluge:\u003e= 0, \u003c 2.1.0.

GHSA-5c8p-qhch-qhx6MediumCVSS 6.1

Deluge Web-UI vulnerable to XSS through a crafted torrent file

Vendor

GitHub Security Advisories

Published

August 27, 2022

Last Modified

September 16, 2024

🔗 CVE IDs covered (1)

CVE-2021-3427 →

📋 Description

The Deluge Web-UI is vulnerable to cross-site scripting through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.

🎯 Affected products1

pip/deluge:>= 0, < 2.1.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2021-3427
https://dev.deluge-torrent.org/ticket/3459
https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEg
https://github.com/pypa/advisory-database/tree/main/vulns/deluge/PYSEC-2022-256.yaml
https://github.com/advisories/GHSA-5c8p-qhch-qhx6
https://security.gentoo.org/glsa/202210-07