LinkedIn Oncall vulnerable to Cross-Site Scripting

MEDIO 6.1CVE-2021-26722 · GHSA-rfw2-x9f8-2f6m · PYSEC-2021-33 · Published 05/02/2021 · updated 17/06/2026

In breve

CVE-2021-26722 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda oncall, oncall (linkedin).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.2%, superiore al 88.2% delle vulnerabilità.
Correzione: aggiornare a 1.4.1 o successiva.

Package	Affected versions	Patched versions
oncall PyPI	`< 1.4.1`	`1.4.1`
oncall linkedin	`≤ 1.4.0`	No fix yet

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.

NVD description

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.