要点
- CVE-2024-23341 是影响 tuitse-tsusin, tuitse-tsusin (ithuan) 的中危 (CVSS 6.1)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.43%，高于 37.3% 的漏洞。
- 修复：升级到 1.3.2 或更高版本。
Description
Impact
When using tuitse_html without quoting the input, there is a html injection vulnerability. It should use the django version django.utils.html.format_html, instead of string.format()
Patches
Upgrade to version 1.3.2.
Workarounds
Sanitizing Taigi input with HTML quotation.
References
https://github.com/i3thuan5/TuiTse-TsuSin/pull/22
NVD description
TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using `tuitse_html` without quoting the input, there is a html injection vulnerability. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input with HTML quotation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free