CVE-2021-39286: Cross-site scripting in pywb – CVSS 6.1 · Watchpost

← All vulnerabilities

Cross-site scripting in pywb

보통 6.1CVE-2021-39286 · GHSA-947x-pv47-pp3q · PYSEC-2021-120 · Published 18/08/2021 · updated 17/06/2026

요약

CVE-2021-39286은(는) pywb, pywb (webrecorder)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.70%, 전체 취약점의 53.4%보다 높음.
조치: 2.6.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
pywb PyPI	`< 2.6.0`	`2.6.0`
pywb webrecorder	`< 2.6.0`	`2.6.0`

Description

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.

NVD description

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.

References

nvd.nist.gov/vuln/detail/CVE-2021-39286 · ADVISORY
webrecorder/pywb commit f7bd84c · WEB
GitHub Advisory GHSA-947x-pv47-pp3q · ADVISORY
pypa/advisory-database · WEB
webrecorder/pywb · PACKAGE
webrecorder/pywb · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free