GitHub Advisoryadvisory · PyPI

GHSA-m4m5-j36m-8x72 html injection vulnerability in the `tuitse_html` function.

MEDIUM Published 2024-01-22 Modified 2024-11-18 Official page ↗
Aliases
CVE-2024-23341
Ecosystem
PyPI
Packages
TuiTse-TsuSin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-01-22

Affected packages

• PyPI TuiTse-TsuSin: < 1.3.2 → fixed in 1.3.2

Description

Impact When using `tuitse_html` without quoting the input, there is a html injection vulnerability. It should use the django version `django.utils.html.format_html`, instead of `string.format()` Patches Upgrade to version 1.3.2. Workarounds Sanitizing Taigi input with HTML quotation. References https://github.com/i3thuan5/TuiTse-TsuSin/pull/22

Related

Alias · CVE (1)

  • CVE-2024-23341 TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References