LinkedIn Oncall vulnerable to Cross-Site Scripting

MÉDIO 6.1CVE-2021-26722 · GHSA-rfw2-x9f8-2f6m · PYSEC-2021-33 · Published 05/02/2021 · updated 17/06/2026

Em resumo

CVE-2021-26722 é uma vulnerabilidade MÉDIO (CVSS 6.1) que afeta oncall, oncall (linkedin).
Chance de exploração nos próximos 30 dias (EPSS): 3.2%, maior que 88.2% das vulnerabilidades.
Correção: atualize para 1.4.1 ou posterior.

Package	Affected versions	Patched versions
oncall PyPI	`< 1.4.1`	`1.4.1`
oncall linkedin	`≤ 1.4.0`	No fix yet

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.

NVD description

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.