GHSA-927p-xrc2-x2gj

ansibleguy-webui Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-36110

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ansibleguy-webui	< 0.0.21	0.0.21

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Multiple forms in version <0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. ### Patches We recommend to upgrade to version >= [0.0.21](https://github.com/ansibleguy/webui/releases/tag/0.0.21) ### References * [Report](https://github.com/ansibleguy/webui/files/15358522/Report.pdf) * [GitHub Issue 44](https://github.com/ansibleguy/webui/issues/44)

References

External links from the advisory. They lead to third-party sites.

https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj web
https://nvd.nist.gov/vuln/detail/CVE-2024-36110 advisory
https://github.com/ansibleguy/webui/issues/44 web
https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522 web
https://github.com/ansibleguy/webui package
https://github.com/ansibleguy/webui/files/15358522/Report.pdf web