https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 11:41:58 +0000 https://db.gcve.eu/vuln/cve-2026-73374 <p><strong>Affected:</strong> vulnerability-lookup</p> <p>A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records.</p> <p>Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements and the resulting string was wrapped in markupsafe.Markup. Because Markup marks the generated content as safe, Jinja&#39;s automatic HTML escaping was bypassed.</p> <p>An authenticated user with permissions to create or modify vulnerability records, such as a user holding the vulnerability:create or vulnerability:modify permission, could submit a crafted reference tag through the CNA API containing arbitrary HTML or JavaScript-capable markup.</p> <p>The malicious value would subsequently be stored as part of the vulnerability record. When another user visited the corresponding public /cve/&lt;id&gt; or /vuln/&lt;id&gt; page, the crafted tag would be rendered as HTML in the viewer&#39;s browser. This could result in JavaScript execution in the security context of the Vulnerability-Lookup application.</p> <p>Successful exploitation could allow an attacker to perform actions in the context of a victim, access information available to the victim&#39;s browser session, or modify page content. As the affected vulnerability pages can be accessed publicly, exploitation may affect users who are not authenticated.</p> <p>The issue was corrected by applying markupsafe.escape() to each reference tag before inserting it into the HTML badge markup, wh…</p> <p><strong>Affected:</strong> vulnerability-lookup</p> <p>A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records.</p> <p>Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements and the resulting string was wrapped in markupsafe.Markup. Because Markup marks the generated content as safe, Jinja&#39;s automatic HTML escaping was bypassed.</p> <p>An authenticated user with permissions to create or modify vulnerability records, such as a user holding the vulnerability:create or vulnerability:modify permission, could submit a crafted reference tag through the CNA API containing arbitrary HTML or JavaScript-capable markup.</p> <p>The malicious value would subsequently be stored as part of the vulnerability record. When another user visited the corresponding public /cve/&lt;id&gt; or /vuln/&lt;id&gt; page, the crafted tag would be rendered as HTML in the viewer&#39;s browser. This could result in JavaScript execution in the security context of the Vulnerability-Lookup application.</p> <p>Successful exploitation could allow an attacker to perform actions in the context of a victim, access information available to the victim&#39;s browser session, or modify page content. As the affected vulnerability pages can be accessed publicly, exploitation may affect users who are not authenticated.</p> <p>The issue was corrected by applying markupsafe.escape() to each reference tag before inserting it into the HTML badge markup, wh…</p> https://db.gcve.eu/vuln/cve-2026-73374