LinkedIn Oncall vulnerable to Cross-Site Scripting

中危 6.1CVE-2021-26722 · GHSA-rfw2-x9f8-2f6m · PYSEC-2021-33 · Published 05/02/2021 · updated 17/06/2026

要点

Package	Affected versions	Patched versions
oncall PyPI	`< 1.4.1`	`1.4.1`
oncall linkedin	`≤ 1.4.0`	No fix yet

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.

NVD description

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.