CVE-2021-39286

Description

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.

How to fix CVE-2021-39286

To remediate CVE-2021-39286, upgrade the affected package to a fixed version below.

• PyPI/pywb—upgrade to 2.6.0 or later
• PyPI/pywb—upgrade to f7bd84cdacdd665ff73ae8d09a202f60be2ebae9 or later

Is CVE-2021-39286 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 2.6.0
• from 0, < f7bd84cdacdd665ff73ae8d09a202f60be2ebae9 | from 0, < 2.6.0

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-947x-pv47-pp3q
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-39286
• PATCHgithub.com/webrecorder/pywb
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/pywb/PYSEC-2021-120.yaml