https://vulnerability.circl.lu/sightings/feed 2026-08-29T21:38:32.549109+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/cb5fa038-e429-463e-89af-45b9558b499f/export 2026-08-29T21:38:32.578026+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "cb5fa038-e429-463e-89af-45b9558b499f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54770", "type": "published-proof-of-concept", "source": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g", "content": "", "creation_timestamp": "2026-08-28T00:35:03.475707Z"} 2026-08-28T00:35:03.475707+00:00 https://vulnerability.circl.lu/sighting/27fed2a0-a187-4ae6-8811-a555a81c0b93/export 2026-08-29T21:38:32.580431+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "27fed2a0-a187-4ae6-8811-a555a81c0b93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54770", "type": "seen", "source": "https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187", "content": "# CVE-2026-54770: CVE-2026-54770: Open Redirect via Parser Differential in WebOb\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-08-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54770\n\n## Summary\nAn open redirect vulnerability exists in WebOb before version 1.8.11 due to a parser differential between WebOb's validation logic and Python's standard urllib.parse.urljoin() function. Under Python 3.10+, the urljoin function strips leading and trailing space characters and C0 control characters, which allowed specially crafted inputs to bypass WebOb's prefix checks while still resolving as off-host redirects.\n\n## TL;DR\nA parser differential between WebOb and Python's urljoin on modern runtimes allows unauthenticated attackers to bypass open redirect protections using leading spaces or control characters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-601\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.1 (Medium)\n- **EPSS Score**: 0.00339 (0.34%)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Open Redirect / Phishing\n\n## Affected Systems\n\n- WebOb on Python 3.10+\n- **WebOb**: < 1.8.11 (Fixed in: `1.8.11`)\n\n## Mitigation\n\n- Upgrade the WebOb library to version 1.8.11 or later.\n- Implement application-layer validation to reject redirection inputs containing leading whitespace or control characters.\n- Deploy Web Application Firewall (WAF) filters to intercept and block anomalous redirection headers.\n\n**Remediation Steps:**\n1. Execute `pip install --upgrade webob` to pull the latest security release.\n2. Confirm requirements.txt or pipfile contains strict pinning of `webob>=1.8.11`.\n3. Verify redirection flows within legacy application code to ensure all redirect functions utilize the standardized validation paths.\n\n## References\n\n- [https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g](https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g)\n- [https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07](https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07)\n- [https://github.com/Pylons/webob/tree/1.8.11](https://github.com/Pylons/webob/tree/1.8.11)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-54770](https://nvd.nist.gov/vuln/detail/CVE-2026-54770)\n- [https://www.cve.org/CVERecord?id=CVE-2026-54770](https://www.cve.org/CVERecord?id=CVE-2026-54770)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54770) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T00:01:48.985383Z"} 2026-08-28T00:01:48.985383+00:00 https://vulnerability.circl.lu/sighting/a6838290-5a49-4c6a-8fcb-15fe38922b0f/export 2026-08-29T21:38:32.581626+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a6838290-5a49-4c6a-8fcb-15fe38922b0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54770", "type": "seen", "source": "https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187", "content": "# CVE-2026-54770: CVE-2026-54770: Open Redirect via Parser Differential in WebOb\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-08-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54770\n\n## Summary\nAn open redirect vulnerability exists in WebOb before version 1.8.11 due to a parser differential between WebOb's validation logic and Python's standard urllib.parse.urljoin() function. Under Python 3.10+, the urljoin function strips leading and trailing space characters and C0 control characters, which allowed specially crafted inputs to bypass WebOb's prefix checks while still resolving as off-host redirects.\n\n## TL;DR\nA parser differential between WebOb and Python's urljoin on modern runtimes allows unauthenticated attackers to bypass open redirect protections using leading spaces or control characters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-601\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.1 (Medium)\n- **EPSS Score**: 0.00339 (0.34%)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Open Redirect / Phishing\n\n## Affected Systems\n\n- WebOb on Python 3.10+\n- **WebOb**: < 1.8.11 (Fixed in: `1.8.11`)\n\n## Mitigation\n\n- Upgrade the WebOb library to version 1.8.11 or later.\n- Implement application-layer validation to reject redirection inputs containing leading whitespace or control characters.\n- Deploy Web Application Firewall (WAF) filters to intercept and block anomalous redirection headers.\n\n**Remediation Steps:**\n1. Execute `pip install --upgrade webob` to pull the latest security release.\n2. Confirm requirements.txt or pipfile contains strict pinning of `webob>=1.8.11`.\n3. Verify redirection flows within legacy application code to ensure all redirect functions utilize the standardized validation paths.\n\n## References\n\n- [https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g](https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g)\n- [https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07](https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07)\n- [https://github.com/Pylons/webob/tree/1.8.11](https://github.com/Pylons/webob/tree/1.8.11)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-54770](https://nvd.nist.gov/vuln/detail/CVE-2026-54770)\n- [https://www.cve.org/CVERecord?id=CVE-2026-54770](https://www.cve.org/CVERecord?id=CVE-2026-54770)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54770) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-27T23:33:29.052985Z"} 2026-08-27T23:33:29.052985+00:00