GHSA-hh7j-pg39-q563

toui allows user-specific variables to be shared between users

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-33175

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	toui	>= 2.0.1, < 2.4.1	2.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Websites that use `Website.user_vars` property in versions. ### Patches It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1 ### Workarounds Do not use `Website.user_vars` in websites when using versions v2.0.1 to v2.4.0. Also, do not use `Website.signin_user()` in version v2.4.0 only. ### Explanation ToUI is using Flask-Caching (SimpleCache) to store user variables. My misunderstanding was that these caches are stored in the client's browser, but it seems that these are stored in the server side.

References

External links from the advisory. They lead to third-party sites.

https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563 web
https://nvd.nist.gov/vuln/detail/CVE-2023-33175 advisory
https://github.com/mubarakalmehairbi/ToUI package
https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1 web