What is GHSA-7wxf-r2qv-9xwr?

GHSA-7wxf-r2qv-9xwr is a security advisory published by GitHub Security Advisories with Medium severity. Docassemble open redirect

Which CVE IDs does GHSA-7wxf-r2qv-9xwr cover?

GHSA-7wxf-r2qv-9xwr covers the following CVE IDs: CVE-2024-27291. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7wxf-r2qv-9xwr?

GHSA-7wxf-r2qv-9xwr has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-7wxf-r2qv-9xwr?

GHSA-7wxf-r2qv-9xwr affects 1 product, including: pip/docassemble.webapp:\u003c 1.4.97.

GHSA-7wxf-r2qv-9xwrMediumCVSS 6.1

Docassemble open redirect

Vendor

GitHub Security Advisories

Published

February 29, 2024

Last Modified

March 24, 2026

🔗 CVE IDs covered (1)

CVE-2024-27291 →

📋 Description

Impact

It is possible to create a URL that acts as an open redirect.

Patches

The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched.

Workarounds

If upgrading is not possible, manually apply the changes of 4801ac7 and restart the server (e.g., by pressing Save on the Configuration screen).

Credit

The vulnerability was discovered by Riyush Ghimire (@richighimi).

For more information

If you have any questions or comments about this advisory:

Open an issue in docassemble
Join the Slack channel
Email us at [email protected]

🎯 Affected products1

pip/docassemble.webapp:< 1.4.97

🔗 References (4)

https://github.com/jhpyle/docassemble/security/advisories/GHSA-7wxf-r2qv-9xwr
https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac09523077930cdb6dea2aa
https://nvd.nist.gov/vuln/detail/CVE-2024-27291
https://github.com/advisories/GHSA-7wxf-r2qv-9xwr