Inventree vulnerable to Stored Cross-site Scripting

MEDIO 5.4CVE-2022-3355 · GHSA-62g7-fpv9-v95f · PYSEC-2026-823 · Published 29/09/2022 · updated 17/06/2026

In breve

CVE-2022-3355 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda inventree, inventree (inventree project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.87%, superiore al 58.9% delle vulnerabilità.
Correzione: aggiornare a 0.8.3 o successiva.

Package	Affected versions	Patched versions
inventree PyPI	`< 0.8.3`	`0.8.3`
inventree inventree_project	`< 0.8.3`	`0.8.3`

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

NVD description

Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

< 0.8.3

0.8.3

< 0.8.3

0.8.3

Altre vulnerabilità di inventree

Vedi tutto →