~ / search / GHSA-g67g-hvc3-xmvf

GHSA-g67g-hvc3-xmvf

Inconsistent input sanitisation leads to XSS vectors

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-41132

Packages

EcosystemPackageAffectedFixed in
PyPI omero-web < 5.11.0 5.11.0
PyPI omero-figure < 4.4.1 4.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Background A variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of XSS possibilities with specially crafted input to a variety of fields. ### Impact OMERO.web before 5.11.0 and OMERO.figure before 4.4.1. ### Patches Users should upgrade OMERO.web to 5.11.0 or higher and OMERO.figure to 4.4.1 or higher.

References

External links from the advisory. They lead to third-party sites.