GHSA-vqxw-9pg7-v7v9

Locust Stored Cross-site Scripting Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-28364

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	locust	< 1.3.2	1.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-28364 advisory
https://github.com/locustio/locust/pull/1603 web
https://github.com/locustio/locust/commit/0d118179709b4a60174810bae4db41d40e4c99ad web
https://github.com/locustio/locust/commit/4049173b3466da236b1d8d8d3519e73c01525a0d web
https://docs.locust.io/en/stable/changelog.html web
https://github.com/locustio/locust package
https://github.com/pypa/advisory-database/tree/main/vulns/locust/PYSEC-2020-60.yaml web