What is GHSA-947x-pv47-pp3q?

GHSA-947x-pv47-pp3q is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site scripting in pywb

Which CVE IDs does GHSA-947x-pv47-pp3q cover?

GHSA-947x-pv47-pp3q covers the following CVE IDs: CVE-2021-39286. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-947x-pv47-pp3q?

GHSA-947x-pv47-pp3q has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-947x-pv47-pp3q?

GHSA-947x-pv47-pp3q affects 1 product, including: pip/pywb:\u003c 2.6.0.

GHSA-947x-pv47-pp3qMediumCVSS 6.1

Cross-site scripting in pywb

Vendor

GitHub Security Advisories

Published

September 2, 2021

Last Modified

October 25, 2024

🔗 CVE IDs covered (1)

CVE-2021-39286 →

📋 Description

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.

🎯 Affected products1

pip/pywb:< 2.6.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-39286
https://github.com/webrecorder/pywb/commit/f7bd84cdacdd665ff73ae8d09a202f60be2ebae9
https://github.com/webrecorder/pywb/compare/v-2.5.0...v-2.6.0
https://github.com/advisories/GHSA-947x-pv47-pp3q
https://github.com/pypa/advisory-database/tree/main/vulns/pywb/PYSEC-2021-120.yaml