GHSA-m4m5-j36m-8x72
Vulnerability from github
Published
2024-01-22 21:32
Modified
2024-01-23 18:42
Severity
Summary
html injection vulnerability in the `tuitse_html` function.
Details
Impact
When using tuitse_html without quoting the input, there is a html injection vulnerability. It should use the django version django.utils.html.format_html, instead of string.format()
Patches
Upgrade to version 1.3.2.
Workarounds
Sanitizing Taigi input with HTML quotation.
References
https://github.com/i3thuan5/TuiTse-TsuSin/pull/22
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "TuiTse-TsuSin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-23341"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-22T21:32:52Z",
"nvd_published_at": "2024-01-23T18:15:19Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nWhen using `tuitse_html` without quoting the input, there is a html injection vulnerability. It should use the django version `django.utils.html.format_html`, instead of `string.format()`\n\n### Patches\n\nUpgrade to version 1.3.2.\n\n### Workarounds\n\n\nSanitizing Taigi input with HTML quotation.\n\n### References\n\n\nhttps://github.com/i3thuan5/TuiTse-TsuSin/pull/22",
"id": "GHSA-m4m5-j36m-8x72",
"modified": "2024-01-23T18:42:37Z",
"published": "2024-01-22T21:32:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/i3thuan5/TuiTse-TsuSin/security/advisories/GHSA-m4m5-j36m-8x72"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23341"
},
{
"type": "WEB",
"url": "https://github.com/i3thuan5/TuiTse-TsuSin/pull/22"
},
{
"type": "WEB",
"url": "https://github.com/i3thuan5/TuiTse-TsuSin/commit/9d21d99d7cfcd7c42aade251fab98ec102e730ea"
},
{
"type": "PACKAGE",
"url": "https://github.com/i3thuan5/TuiTse-TsuSin"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tuitse-tsusin/PYSEC-2024-22.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "html injection vulnerability in the `tuitse_html` function."
}
Loading...