GitHub Advisoryadvisory · PyPI

GHSA-g2vg-8hfg-79vj Koji Cross-site Scripting

MEDIUM Published 2024-12-24 Modified 2025-02-07 Official page ↗
Aliases
CVE-2024-9427
Ecosystem
PyPI
Packages
koji
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-116
Reviewed
2024-12-26

Affected packages

• PyPI koji: >= 1.35.0, < 1.35.1 → fixed in 1.35.1 • PyPI koji: >= 1.34.0, < 1.34.3 → fixed in 1.34.3 • PyPI koji: < 1.33.2 → fixed in 1.33.2

Description

A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web page. It is not expected to be able to submit an action or make a change in Koji due to existing XSS protections in the code.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-116 Improper Encoding or Escaping of Output weakness

References