CWE-116
Allowed-with-ReviewImproper Encoding or Escaping of Output
Abstraction: Class · Status: Draft
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
806 vulnerabilities reference this CWE, most recent first.
GHSA-92HF-4CHR-8HRF
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality
{
"affected": [],
"aliases": [
"CVE-2020-25646"
],
"database_specific": {
"cwe_ids": [
"CWE-116"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-29T20:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality",
"id": "GHSA-92hf-4chr-8hrf",
"modified": "2022-05-24T17:32:32Z",
"published": "2022-05-24T17:32:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25646"
},
{
"type": "WEB",
"url": "https://github.com/ansible-collections/community.crypto/commit/233d1afc296f6770e905a1785ee2f35af7605e43"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9395-2G46-RJ3F
Vulnerability from github – Published: 2026-09-17 20:31 – Updated: 2026-09-17 20:31Five independent defects in djust's template auto-escaping cause attacker-controlled input to be rendered as live markup where Django escapes it. All four are present in shipped 1.1.0 and are fixed in 1.1.1.
They share one shape: a filter or grant that escapes nothing itself and relies on the render-time auto-escape, which something downstream then removes. They are grouped into a single advisory because the mitigation is identical — upgrade to 1.1.1 — and because no single one of them is meaningfully actionable in isolation.
1. linenumbers never escaped its input (#2291)
{{ p|linenumbers|safe }} with p = '<img src=x onerror=alert(1)>'
djust '1. <img src=x onerror=alert(1)>' <- executes
django '1. <img src=x onerror=alert(1)>'
The filter deferred all escaping to render time; a trailing |safe suppressed exactly that. The exposure is wider than the |safe form: any downstream filter that reads the output as markup is affected, including {{ p|linenumbers|truncatechars_html:"5" }}, which contains no |safe at all.
2. escape was a no-op (#2281)
{{ p|escape|safe }}
djust '<img src=x onerror=alert(1)>' <- executes
django '&lt;img src=x onerror=alert(1)&gt;'
Django's escape is eager (conditional_escape, returning SafeString). djust's returned its input unchanged and let the render site escape it — indistinguishable for {{ p|escape }} alone, wrong for every chain. The security cell is {{ p|escape|safe }}: an idiom that reads as "escape it, then it is safe to emit" — which is what Django's semantics make true — was a bare |safe on attacker input. A sweep of every length-2 and length-3 chain containing escape found 104 live-markup cells.
3. unordered_list / safeseq handed a string back under a safe grant (#2274)
Both carry an unconditional "emit without escaping" grant, earned because they escape every item they emit. Given a string rather than a sequence they emitted nothing and returned the input verbatim under that same grant, making {{ hostile|safeseq }} an exact synonym for |safe with no mark_safe anywhere in the template.
4. A safety grant outlived the value it was granted for (#2300)
No filter chain and no |safe anywhere; a bare {{ p }} is the whole reproducer.
Safe context keys accumulated on the view and were never revoked, so a key marked safe once stayed safe for the lifetime of the view — which spans every event on a WebSocket connection:
render 1: p = mark_safe('<b>trusted</b>') -> '<b>trusted</b>' correct
render 2: p = '<img src=x onerror=alert(1)>' -> executes
A view that renders trusted markup into a variable and later renders user input into the same variable emits it live.
5. A custom tag handler's return was emitted raw — including djust's own {% render_slot %} (#2379)
Reachable with no |safe, no mark_safe, and no application code: using component slots is enough.
Django's SimpleNode.render runs conditional_escape over a simple_tag's return
unless it carries __html__. djust inserted the return verbatim, so a handler as
ordinary as return f"Hello {name}" emitted attacker markup live.
Of the 221 handlers djust registers, one echoes a context value unescaped —
render_slot, the framework's own function-component/slot tag:
{% render_slot p %} p = '<img src=x onerror=alert(1)>'
djust '<img src=x onerror=alert(1)>' <- executes
django '<img src=x onerror=alert(1)>'
Together with defect 3 this is one of the two classes reachable without the application writing anything unusual.
6. linebreaks / linebreaksbr — and |safe was the only spelling that worked (#2284)
linebreaks emits <p>/<br> but neither escaped its content nor reported its
output safe. The plain spelling therefore escaped the filter's own tags and
printed a literal <p> on the page, so |safe was the only form that rendered
at all — and that form emitted the content live:
{{ bio|linebreaks }} renders literal '<p>' text (visibly broken)
{{ bio|linebreaks|safe }} '<img src=x onerror=alert(1)>' <- executes
Because the broken spelling is the one a developer discards, the vulnerable spelling is the one that ships. Any application rendering user-entered text with paragraph breaks is written that way.
Impact
Stored or reflected XSS in any djust application that renders untrusted input through the affected filters, or that reuses a context variable which was previously marked safe. Exploitation requires no special configuration. Defects 3, 4 and 5 require no unusual template construct at all — defect 5 needs only that the application use component slots, and defect 6's vulnerable spelling is the only one that renders correctly.
Patches
Fixed in 1.1.1, and in 1.2.0 (main).
1.1.1 re-implements each fix against 1.1.0's own code rather than back-porting main's, which depends on a value-level safety model 1.1.0 does not have. Three consequences are documented in the 1.1.1 CHANGELOG and are all in the over-escaping direction: {{ p|escape|F }} double-escapes for a plain following filter F; {% render_slot slot.content %} over-escapes; and a mark_safed value passed through |escape is escaped rather than passed through.
Not fixed in 1.1.1, and tracked separately: application-written tag handlers that return attacker data as a plain str (only djust's own render_slot is covered by defect 5), and a {% with %}/{% for %} bind inheriting a safety grant it never earned. Both are fixed in 1.2.0.
Workarounds
None complete. Before upgrading, avoid |safe after any filter in a chain, avoid safeseq/unordered_list on values that may be strings, and avoid reusing a context variable for both mark_safe content and untrusted input.
Credit
Found during an internal Django-parity audit by a registry-wide differential that compares djust's escaping capabilities against Django's across every filter chain, rather than by inspection.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.1.0"
},
"package": {
"ecosystem": "PyPI",
"name": "djust"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-17T20:31:43Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Five independent defects in djust\u0027s template auto-escaping cause attacker-controlled input to be rendered as live markup where Django escapes it. All four are present in shipped 1.1.0 and are fixed in 1.1.1.\n\nThey share one shape: **a filter or grant that escapes nothing itself and relies on the render-time auto-escape, which something downstream then removes.** They are grouped into a single advisory because the mitigation is identical \u2014 upgrade to 1.1.1 \u2014 and because no single one of them is meaningfully actionable in isolation.\n\n## 1. `linenumbers` never escaped its input (#2291)\n\n```\n{{ p|linenumbers|safe }} with p = \u0027\u003cimg src=x onerror=alert(1)\u003e\u0027\n djust \u00271. \u003cimg src=x onerror=alert(1)\u003e\u0027 \u003c- executes\n django \u00271. \u0026lt;img src=x onerror=alert(1)\u0026gt;\u0027\n```\n\nThe filter deferred all escaping to render time; a trailing `|safe` suppressed exactly that. The exposure is wider than the `|safe` form: **any downstream filter that reads the output as markup is affected**, including `{{ p|linenumbers|truncatechars_html:\"5\" }}`, which contains no `|safe` at all.\n\n## 2. `escape` was a no-op (#2281)\n\n```\n{{ p|escape|safe }}\n djust \u0027\u003cimg src=x onerror=alert(1)\u003e\u0027 \u003c- executes\n django \u0027\u0026amp;lt;img src=x onerror=alert(1)\u0026amp;gt;\u0027\n```\n\nDjango\u0027s `escape` is eager (`conditional_escape`, returning `SafeString`). djust\u0027s returned its input unchanged and let the render site escape it \u2014 indistinguishable for `{{ p|escape }}` alone, wrong for every chain. The security cell is `{{ p|escape|safe }}`: an idiom that reads as \"escape it, then it is safe to emit\" \u2014 which is what Django\u0027s semantics make true \u2014 was a bare `|safe` on attacker input. A sweep of every length-2 and length-3 chain containing `escape` found **104** live-markup cells.\n\n## 3. `unordered_list` / `safeseq` handed a string back under a safe grant (#2274)\n\nBoth carry an unconditional \"emit without escaping\" grant, earned because they escape every item they emit. Given a **string** rather than a sequence they emitted nothing and returned the input verbatim under that same grant, making `{{ hostile|safeseq }}` an exact synonym for `|safe` with no `mark_safe` anywhere in the template.\n\n## 4. A safety grant outlived the value it was granted for (#2300)\n\n**No filter chain and no `|safe` anywhere; a bare `{{ p }}` is the whole reproducer.**\n\nSafe context keys accumulated on the view and were never revoked, so a key marked safe once stayed safe for the lifetime of the view \u2014 which spans **every event on a WebSocket connection**:\n\n```python\nrender 1: p = mark_safe(\u0027\u003cb\u003etrusted\u003c/b\u003e\u0027) -\u003e \u0027\u003cb\u003etrusted\u003c/b\u003e\u0027 correct\nrender 2: p = \u0027\u003cimg src=x onerror=alert(1)\u003e\u0027 -\u003e executes\n```\n\nA view that renders trusted markup into a variable and later renders user input into the same variable emits it live.\n\n## 5. A custom tag handler\u0027s return was emitted raw \u2014 including djust\u0027s own `{% render_slot %}` (#2379)\n\n**Reachable with no `|safe`, no `mark_safe`, and no application code: using component slots is enough.**\n\nDjango\u0027s `SimpleNode.render` runs `conditional_escape` over a `simple_tag`\u0027s return\nunless it carries `__html__`. djust inserted the return verbatim, so a handler as\nordinary as `return f\"Hello {name}\"` emitted attacker markup live.\n\nOf the 221 handlers djust registers, one echoes a context value unescaped \u2014\n`render_slot`, the framework\u0027s own function-component/slot tag:\n\n```\n{% render_slot p %} p = \u0027\u003cimg src=x onerror=alert(1)\u003e\u0027\n\n djust \u0027\u003cimg src=x onerror=alert(1)\u003e\u0027 \u003c- executes\n django \u0027\u0026lt;img src=x onerror=alert(1)\u0026gt;\u0027\n```\n\nTogether with defect 3 this is one of the two classes reachable without the\napplication writing anything unusual.\n\n## 6. `linebreaks` / `linebreaksbr` \u2014 and `|safe` was the only spelling that worked (#2284)\n\n`linebreaks` emits `\u003cp\u003e`/`\u003cbr\u003e` but neither escaped its content nor reported its\noutput safe. The plain spelling therefore escaped the filter\u0027s **own** tags and\nprinted a literal `\u003cp\u003e` on the page, so `|safe` was the only form that rendered\nat all \u2014 and that form emitted the content live:\n\n```\n{{ bio|linebreaks }} renders literal \u0027\u003cp\u003e\u0027 text (visibly broken)\n{{ bio|linebreaks|safe }} \u0027\u003cimg src=x onerror=alert(1)\u003e\u0027 \u003c- executes\n```\n\nBecause the broken spelling is the one a developer discards, the vulnerable\nspelling is the one that ships. Any application rendering user-entered text with\nparagraph breaks is written that way.\n\n## Impact\n\nStored or reflected XSS in any djust application that renders untrusted input through the affected filters, or that reuses a context variable which was previously marked safe. Exploitation requires no special configuration. Defects 3, 4 and 5 require no unusual template construct at all \u2014 defect 5 needs only that the application use component slots, and defect 6\u0027s vulnerable spelling is the only one that renders correctly.\n\n## Patches\n\nFixed in **1.1.1**, and in **1.2.0** (`main`).\n\n1.1.1 re-implements each fix against 1.1.0\u0027s own code rather than back-porting `main`\u0027s, which depends on a value-level safety model 1.1.0 does not have. Three consequences are documented in the 1.1.1 CHANGELOG and are all in the **over-escaping** direction: `{{ p|escape|F }}` double-escapes for a plain following filter `F`; `{% render_slot slot.content %}` over-escapes; and a `mark_safe`d value passed through `|escape` is escaped rather than passed through.\n\n**Not fixed in 1.1.1**, and tracked separately: application-written tag handlers that return attacker data as a plain `str` (only djust\u0027s own `render_slot` is covered by defect 5), and a `{% with %}`/`{% for %}` bind inheriting a safety grant it never earned. Both are fixed in 1.2.0.\n\n## Workarounds\n\nNone complete. Before upgrading, avoid `|safe` after any filter in a chain, avoid `safeseq`/`unordered_list` on values that may be strings, and avoid reusing a context variable for both `mark_safe` content and untrusted input.\n\n## Credit\n\nFound during an internal Django-parity audit by a registry-wide differential that compares djust\u0027s escaping capabilities against Django\u0027s across every filter chain, rather than by inspection.",
"id": "GHSA-9395-2g46-rj3f",
"modified": "2026-09-17T20:31:43Z",
"published": "2026-09-17T20:31:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/djust-org/djust/security/advisories/GHSA-9395-2g46-rj3f"
},
{
"type": "PACKAGE",
"url": "https://github.com/djust-org/djust"
},
{
"type": "WEB",
"url": "https://github.com/djust-org/djust/releases/tag/v1.1.1"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)"
}
GHSA-9525-27VJ-C8R8
Vulnerability from github – Published: 2026-05-06 20:10 – Updated: 2026-06-08 23:58Summary
A stored XSS vulnerability in the comment rendering pipeline allows an authenticated user to inject JavaScript that executes for every visitor of an affected FAQ or News page. An attacker with a registered account can steal admin session cookies and take over the application.
Details
Utils::parseUrl() (phpmyfaq/src/phpMyFAQ/Utils.php, line 281) converts URLs in comment text into clickable <a> tags at render time:
$pattern = '/(https?:\/\/[^\s]+)/i';
$replacement = '<a href="$1">$1</a>';
return preg_replace($pattern, $replacement, $string);
The regex [^\s]+ matches " and <, and the URL is inserted into the href attribute with no htmlspecialchars() call. A URL with a literal " closes the attribute early and allows injecting event handlers like onmouseover.
This only reaches the sink when main.enableCommentEditor is enabled. In that path, comment text goes through sanitizeHtmlComment() instead of FILTER_SANITIZE_SPECIAL_CHARS — which encodes " — so the double-quote survives to storage. The comment is then passed through parseUrl() and rendered via {{ comment.comment|raw }} in comment.macros.twig (line 40), which disables Twig auto-escaping.
The same sink exists in the admin comment panel (admin/content/comments.twig, lines 62 and 112), so admins viewing the panel are also affected.
No Content-Security-Policy headers are set anywhere in the app.
PoC
Requirements: - main.enableCommentEditor = true (set in admin Configuration panel) - attacker has any registered user account - one FAQ entry with comments allowed exists
Steps: 1. Log in as a registered user and open a FAQ with comments. 2. Submit the following as the comment text:
https://www.evil.com/"onmouseover="alert(document.cookie)
(www. prefix required — parseUrl strips https:// then only re-adds it for www. URLs, which is what triggers the linkification)
- Any user who views that FAQ page and hovers the link triggers the payload. To hit an admin, wait for them to visit the page or check the admin comments panel at /admin/content/comments.
Resulting HTML in the page:
<a href="https://www.evil.com/"onmouseover="alert(document.cookie)">
...
</a>
The " closes the href attribute; onmouseover becomes a real attribute.
Impact
Stored XSS affecting all visitors of the page, including admins. Session cookie theft leads to full admin account takeover. The payload looks like a normal URL and persists until manually deleted.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "thorsten/phpmyfaq"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.1"
},
{
"fixed": "4.1.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.1.1"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyfaq/phpmyfaq"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.1"
},
{
"fixed": "4.1.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.1.1"
]
}
],
"aliases": [
"CVE-2026-46367"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T20:10:48Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nA stored XSS vulnerability in the comment rendering pipeline allows an authenticated user to inject JavaScript that executes for every visitor of an affected FAQ or News page. An attacker with a registered account can steal admin session cookies and take over the application.\n\n### Details\n\n`Utils::parseUrl()` (`phpmyfaq/src/phpMyFAQ/Utils.php`, line 281) converts URLs in comment text into clickable `\u003ca\u003e` tags at render time:\n\n $pattern = \u0027/(https?:\\/\\/[^\\s]+)/i\u0027;\n $replacement = \u0027\u003ca href=\"$1\"\u003e$1\u003c/a\u003e\u0027;\n return preg_replace($pattern, $replacement, $string);\n\nThe regex `[^\\s]+` matches `\"` and `\u003c`, and the URL is inserted into the href attribute with no htmlspecialchars() call. A URL with a literal `\"` closes the attribute early and allows injecting event handlers like onmouseover.\n\nThis only reaches the sink when `main.enableCommentEditor` is enabled. In that path, comment text goes through `sanitizeHtmlComment()` instead of `FILTER_SANITIZE_SPECIAL_CHARS` \u2014 which encodes `\"` \u2014 so the double-quote survives to storage. The comment is then passed through parseUrl() and rendered via `{{ comment.comment|raw }}` in `comment.macros.twig` (line 40), which disables Twig auto-escaping.\n\nThe same sink exists in the admin comment panel (`admin/content/comments.twig`, lines 62 and 112), so admins viewing the panel are also affected.\n\nNo Content-Security-Policy headers are set anywhere in the app.\n\n### PoC\n\nRequirements:\n- main.enableCommentEditor = true (set in admin Configuration panel)\n- attacker has any registered user account\n- one FAQ entry with comments allowed exists\n\nSteps:\n1. Log in as a registered user and open a FAQ with comments.\n2. Submit the following as the comment text:\n\n https://www.evil.com/\"onmouseover=\"alert(document.cookie)\n\n (www. prefix required \u2014 parseUrl strips https:// then only re-adds\n it for www. URLs, which is what triggers the linkification)\n\n3. Any user who views that FAQ page and hovers the link triggers the\n payload. To hit an admin, wait for them to visit the page or check\n the admin comments panel at /admin/content/comments.\n\nResulting HTML in the page:\n\n \u003ca href=\"https://www.evil.com/\"onmouseover=\"alert(document.cookie)\"\u003e\n ...\n \u003c/a\u003e\n\nThe `\"` closes the href attribute; onmouseover becomes a real attribute.\n\n### Impact\n\nStored XSS affecting all visitors of the page, including admins. Session cookie theft leads to full admin account takeover. The payload looks like a normal URL and persists until manually deleted.",
"id": "GHSA-9525-27vj-c8r8",
"modified": "2026-06-08T23:58:14Z",
"published": "2026-05-06T20:10:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9525-27vj-c8r8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46367"
},
{
"type": "PACKAGE",
"url": "https://github.com/thorsten/phpMyFAQ"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/phpmyfaq-stored-xss-via-utils-parseurl-in-comment-rendering"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering"
}
GHSA-95W5-Q9VP-5VRM
Vulnerability from github – Published: 2022-10-24 19:00 – Updated: 2022-10-25 20:22Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.heron:heron-api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.5-incubating"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-42010"
],
"database_specific": {
"cwe_ids": [
"CWE-116"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-25T20:22:49Z",
"nvd_published_at": "2022-10-24T14:15:00Z",
"severity": "CRITICAL"
},
"details": "Heron versions \u003c= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.",
"id": "GHSA-95w5-q9vp-5vrm",
"modified": "2022-10-25T20:22:49Z",
"published": "2022-10-24T19:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42010"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/j65nwr8n7jchngwqptzh100drcr4ry2q"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/10/23/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Heron allows CRLF log injection"
}
GHSA-98WM-CXPW-847P
Vulnerability from github – Published: 2026-03-24 20:40 – Updated: 2026-03-27 21:34Vulnerability Details
Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal.
The line item description field was not passed through purify::clean() before rendering.
Steps to Reproduce
- Login as any authenticated user
- Create or edit an invoice
- In a line item description, enter:
<img src=x onerror=alert(document.cookie)> - Save the invoice and preview it
- The XSS payload executes in the browser
Impact
- Attacker: Any authenticated user who can create invoices
- Victim: Any user viewing the invoice (including clients via the portal)
- Specific damage: Session hijacking, account takeover, data exfiltration
Proposed Fix
Fixed in v5.13.4 by the vendor by adding purify::clean() to sanitize line item descriptions.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "invoiceninja/invoiceninja"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.13.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33628"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-184",
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-24T20:40:16Z",
"nvd_published_at": "2026-03-26T21:17:07Z",
"severity": "MODERATE"
},
"details": "## Vulnerability Details\n\nInvoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal.\n\nThe line item description field was not passed through `purify::clean()` before rendering.\n\n## Steps to Reproduce\n\n1. Login as any authenticated user\n2. Create or edit an invoice\n3. In a line item description, enter: `\u003cimg src=x onerror=alert(document.cookie)\u003e`\n4. Save the invoice and preview it\n5. The XSS payload executes in the browser\n\n## Impact\n\n- **Attacker**: Any authenticated user who can create invoices\n- **Victim**: Any user viewing the invoice (including clients via the portal)\n- **Specific damage**: Session hijacking, account takeover, data exfiltration\n\n## Proposed Fix\n\nFixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.",
"id": "GHSA-98wm-cxpw-847p",
"modified": "2026-03-27T21:34:58Z",
"published": "2026-03-24T20:40:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33628"
},
{
"type": "WEB",
"url": "https://github.com/invoiceninja/invoiceninja/commit/b81a3fc302573fc4a53d61e8537dd19154ce1091"
},
{
"type": "PACKAGE",
"url": "https://github.com/invoiceninja/invoiceninja"
},
{
"type": "WEB",
"url": "https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items"
}
GHSA-9F5V-36FP-5CV6
Vulnerability from github – Published: 2022-05-14 03:11 – Updated: 2022-05-14 03:11The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.
{
"affected": [],
"aliases": [
"CVE-2018-9246"
],
"database_specific": {
"cwe_ids": [
"CWE-116"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-08T01:29:00Z",
"severity": "CRITICAL"
},
"details": "The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.",
"id": "GHSA-9f5v-36fp-5cv6",
"modified": "2022-05-14T03:11:18Z",
"published": "2022-05-14T03:11:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9246"
},
{
"type": "WEB",
"url": "https://archive.ledgersmb.org/ledger-smb-announce/msg00280.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9FHH-GQV6-6CP4
Vulnerability from github – Published: 2022-05-02 03:53 – Updated: 2022-05-02 03:53The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the numRows parameter.
{
"affected": [],
"aliases": [
"CVE-2009-4267"
],
"database_specific": {
"cwe_ids": [
"CWE-116"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-19T16:29:00Z",
"severity": "MODERATE"
},
"details": "The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the numRows parameter.",
"id": "GHSA-9fhh-gqv6-6cp4",
"modified": "2022-05-02T03:53:12Z",
"published": "2022-05-02T03:53:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4267"
},
{
"type": "WEB",
"url": "http://juddi.apache.org/security.html"
},
{
"type": "WEB",
"url": "http://mail-archives.apache.org/mod_mbox/juddi-user/201802.mbox/raw/%3C0F272EE1-E2B4-4016-8C5D-F76ABDD12D18%40gmail.com%3E"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9FWW-8CPR-Q66R
Vulnerability from github – Published: 2026-02-24 16:03 – Updated: 2026-02-24 16:03Impact
This is a stored Cross-Site Scripting (XSS) vulnerability affecting the website and author comment fields. The website field was HTML-escaped using quote=False, which left single and double quotes unescaped. Since the frontend inserts the website value directly into a single-quoted href attribute via string concatenation, a single quote in the URL breaks out of the attribute context, allowing injection of arbitrary event handlers (e.g. onmouseover, onclick).
The same escaping was missing entirely from the user-facing comment edit endpoint (PUT /id/) and the moderation edit endpoint (POST /id//edit/).
Any visitor to a page embedding isso comments is impacted. No authentication or interaction beyond mouse movement is required to trigger a payload — an attacker can post a comment anonymously (moderation is off by default) with a crafted website URL, and the payload persists in the database and fires on every page load. With the full-page invisible overlay technique described in the report, the victim only needs to move their mouse.
Patches
The issue is fixed in commit 3cf27c2. Users should upgrade to a version containing that commit once released. The fix applies html.escape(..., quote=True) to the website field across all three write paths (POST /new, PUT /id/, POST /id//edit/), and adds input validation and escaping to the moderation edit endpoint which previously had neither.
Workarounds
Enabling comment moderation (moderation = enabled = true in isso.cfg) prevents unauthenticated users from publishing comments, raising the bar for exploitation. However, it does not fully mitigate the issue since a moderator activating a malicious comment would still expose visitors. There is no configuration-only workaround that fully prevents the vulnerability.
Resources
- https://docs.python.org/3/library/html.html#html.escape — note the quote parameter
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "isso"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.13.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-27469"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-24T16:03:04Z",
"nvd_published_at": "2026-02-21T08:16:11Z",
"severity": "MODERATE"
},
"details": "## Impact\n\nThis is a stored Cross-Site Scripting (XSS) vulnerability affecting the website and author comment fields. The website field was HTML-escaped using quote=False, which left single and double quotes unescaped. Since the frontend inserts the website value directly into a single-quoted href attribute via string concatenation, a single quote in the URL breaks out of the attribute context, allowing injection of arbitrary event handlers (e.g. onmouseover, onclick).\n\nThe same escaping was missing entirely from the user-facing comment edit endpoint (PUT /id/\u003cid\u003e) and the moderation edit endpoint (POST /id/\u003cid\u003e/edit/\u003ckey\u003e).\n\nAny visitor to a page embedding isso comments is impacted. No authentication or interaction beyond mouse movement is required to trigger a payload \u2014 an attacker can post a comment anonymously (moderation is off by default) with a crafted website URL, and the payload persists in the database and fires on every page load. With the full-page invisible overlay technique described in the report, the victim only needs to move their mouse.\n\n## Patches\n\nThe issue is fixed in commit 3cf27c2. Users should upgrade to a version containing that commit once released. The fix applies html.escape(..., quote=True) to the website field across all three write paths (POST /new, PUT /id/\u003cid\u003e, POST /id/\u003cid\u003e/edit/\u003ckey\u003e), and adds input validation and escaping to the moderation edit endpoint which previously had neither.\n\n## Workarounds\n\n Enabling comment moderation (moderation = enabled = true in isso.cfg) prevents unauthenticated users from publishing comments, raising the bar for exploitation. However, it\n does not fully mitigate the issue since a moderator activating a malicious comment would still expose visitors. There is no configuration-only workaround that fully prevents\n the vulnerability.\n\n## Resources\n\n - https://docs.python.org/3/library/html.html#html.escape \u2014 note the quote parameter",
"id": "GHSA-9fww-8cpr-q66r",
"modified": "2026-02-24T16:03:04Z",
"published": "2026-02-24T16:03:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/isso-comments/isso/security/advisories/GHSA-9fww-8cpr-q66r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27469"
},
{
"type": "WEB",
"url": "https://github.com/isso-comments/isso/commit/0afbfe0691ee237963e8fb0b2ee01c9e55ca2144"
},
{
"type": "WEB",
"url": "https://docs.python.org/3/library/html.html#html.escape"
},
{
"type": "PACKAGE",
"url": "https://github.com/isso-comments/isso"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Isso affected by Stored XSS via comment website field"
}
GHSA-9GC4-XHW7-655H
Vulnerability from github – Published: 2026-10-17 00:31 – Updated: 2026-10-20 21:30Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.
combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, "12\n" passes a check such as $qty > 0 and is then written unquoted with its newline.
A value validated as a number can end the record early and turn the fields after it into a separate row.
{
"affected": [],
"aliases": [
"CVE-2026-110757"
],
"database_specific": {
"cwe_ids": [
"CWE-116"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T23:17:00Z",
"severity": "CRITICAL"
},
"details": "Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.\n\ncombine and print do not check whether a field needs quotes when its value has Perl\u0027s integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, \"12\\n\" passes a check such as $qty \u003e 0 and is then written unquoted with its newline.\n\nA value validated as a number can end the record early and turn the fields after it into a separate row.",
"id": "GHSA-9gc4-xhw7-655h",
"modified": "2026-10-20T21:30:43Z",
"published": "2026-10-17T00:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110757"
},
{
"type": "WEB",
"url": "https://github.com/cpan-authors/Text-CSV_XS/commit/fcfb796cb50de9cef8b94a70535304ac41a50c56.patch"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9GQ4-2485-Q63Q
Vulnerability from github – Published: 2026-07-15 15:33 – Updated: 2026-10-01 18:32A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
{
"affected": [],
"aliases": [
"CVE-2026-15809"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-134"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-15T13:17:03Z",
"severity": "HIGH"
},
"details": "A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.",
"id": "GHSA-9gq4-2485-q63q",
"modified": "2026-10-01T18:32:31Z",
"published": "2026-07-15T15:33:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15809"
},
{
"type": "WEB",
"url": "https://github.com/cri-o/cri-o/pull/6524"
},
{
"type": "WEB",
"url": "https://github.com/cri-o/cri-o/pull/6450"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500846"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2022-4318"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-15809"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:70585"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:67856"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:67836"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:66385"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:65906"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:65838"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:62548"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60452"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60449"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60444"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:57361"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-4.3
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.
- Alternately, use built-in functions, but consider using wrappers in case those functions are discovered to have a vulnerability.
Mitigation MIT-27
Strategy: Parameterization
- If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
- For example, stored procedures can enforce database query structure and reduce the likelihood of SQL injection.
Mitigation
Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies.
Mitigation
In some cases, input validation may be an important strategy when output encoding is not a complete solution. For example, you may be providing the same output that will be processed by multiple consumers that use different encodings or representations. In other cases, you may be required to allow user-supplied input to contain control information, such as limited HTML tags that support formatting in a wiki or bulletin board. When this type of requirement must be met, use an extremely strict allowlist to limit which control sequences can be used. Verify that the resulting syntactic structure is what you expect. Use your normal encoding methods for the remainder of the input.
Mitigation
Use input validation as a defense-in-depth measure to reduce the likelihood of output encoding errors (see CWE-20).
Mitigation
Fully specify which encodings are required by components that will be communicating with each other.
Mitigation
When exchanging data between components, ensure that both components are using the same character encoding. Ensure that the proper encoding is applied at each interface. Explicitly set the encoding you are using whenever the protocol allows you to do so.
CAPEC-104: Cross Zone Scripting
An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security.
CAPEC-73: User-Controlled Filename
An attack of this type involves an adversary inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to pass and exploit these vulnerabilities.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.
CAPEC-85: AJAX Footprinting
This attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. A common first step for an attacker is to footprint the target environment to understand what attacks will work. Since footprinting relies on enumeration, the conversational pattern of rapid, multiple requests and responses that are typical in Ajax applications enable an attacker to look for many vulnerabilities, well-known ports, network locations and so on. The knowledge gained through Ajax fingerprinting can be used to support other attacks, such as XSS.