En bref
- CVE-2024-23341 est une vulnérabilité MOYENNE (CVSS 6.1) touchant tuitse-tsusin, tuitse-tsusin (ithuan).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.43%, plus élevée que 37.3% des vulnérabilités.
- Correctif : mettre à jour vers 1.3.2 ou plus récent.
Description
Impact
When using tuitse_html without quoting the input, there is a html injection vulnerability. It should use the django version django.utils.html.format_html, instead of string.format()
Patches
Upgrade to version 1.3.2.
Workarounds
Sanitizing Taigi input with HTML quotation.
References
https://github.com/i3thuan5/TuiTse-TsuSin/pull/22
NVD description
TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using `tuitse_html` without quoting the input, there is a html injection vulnerability. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input with HTML quotation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free