GitHub Advisoryadvisory · PyPI

GHSA-mxvc-fwgx-j778 Whoogle Search Cross-site Scripting via string parameter

MEDIUM Published 2022-07-15 Modified 2024-11-19 Official page ↗
Aliases
CVE-2022-25303
Ecosystem
PyPI
Packages
whoogle-search
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-07-15

Affected packages

• PyPI whoogle-search: < 0.7.2 → fixed in 0.7.2

Description

The package whoogle-search before version 0.7.2 is vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the flask.render_template function. However, the error_message is rendered using the | safe filter, meaning the user input is not escaped.

Related

Alias · CVE (1)

  • CVE-2022-25303 The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References