Airbnb Knowledge Repo XSS In Comments

MEDIO 6.1CVE-2018-12104 · GHSA-xmw7-848p-p95w · PYSEC-2018-116 · Published 17/06/2018 · updated 17/06/2026

En resumen

CVE-2018-12104 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a knowledge-repo, knowledge repo (airbnb).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.3%, mayor que el 70.1% de las vulnerabilidades.
Solución: actualizar a 0.7.5, 0.9.0 o posterior.

Package	Affected versions	Patched versions
knowledge-repo PyPI	`< 0.7.5< 0.9.0`	`0.7.50.9.0`
knowledge repo airbnb	`= 0.7.4`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo prior to 0.9.0 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/new_report.kp URI.

NVD description

Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/new_report.kp URI.

References

nvd.nist.gov/vuln/detail/CVE-2018-12104 · ADVISORY
airbnb/knowledge-repo · WEB
airbnb/knowledge-repo · WEB
airbnb/knowledge-repo#558 · WEB
airbnb/knowledge-repo commit f026ad2 · WEB
airbnb/knowledge-repo · PACKAGE
pypa/advisory-database · WEB
pypi.org/project/knowledge-repo · WEB
web.archive.org/web/20200227121013/http://www.securityfocus.com/bid/104487 · WEB
securityfocus.com/bid/104487 · Third Party Advisory
GitHub Advisory GHSA-xmw7-848p-p95w · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

knowledge-repo

PyPI

< 0.7.5< 0.9.0

0.7.50.9.0

knowledge repo

airbnb

= 0.7.4

No fix yet

Description

NVD description