GHSA-5m69-3chg-6f8m

Cross Site Scripting (XSS) in Quokka

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-18702

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	quokka	<= 0.4.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-18702 advisory
https://github.com/rochacbruno/quokka/issues/675 web
https://github.com/advisories/GHSA-5m69-3chg-6f8m advisory
https://github.com/pypa/advisory-database/tree/main/vulns/quokka/PYSEC-2021-143.yaml web
https://github.com/rochacbruno/quokka package