Cross-site scripting in sickrage

MEDIUM 6.1CVE-2021-25926 · GHSA-x823-j7c4-vpc5 · PYSEC-2021-148 · Published 12/04/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
sickrage PyPI	`≥ 9.3.54, < 10.0.11.dev2≥ 9.3.55, < 10.0.12.dev1`	`10.0.11.dev210.0.12.dev1`
sickrage sickrage	`= 10.0.11≥ 9.3.54, < 10.0.11`	`10.0.11`

Description

In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the quicksearch feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.

NVD description

In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.

References

nvd.nist.gov/vuln/detail/CVE-2021-25926 · ADVISORY
SiCKRAGE/SiCKRAGE commit 9f42426 · WEB
SiCKRAGE/SiCKRAGE · PACKAGE
pypa/advisory-database · WEB
whitesourcesoftware.com/vulnerability-database/CVE-2021-25926%2C · Exploit
whitesourcesoftware.com/vulnerability-database/CVE-2021-25926, · WEB
GitHub Advisory GHSA-x823-j7c4-vpc5 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free