CVE-2022-25303
Cross-site Scripting (XSS)
概要
Cross-site Scripting (XSS)
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the flask.render_template function. However, the error_message is rendered using the | safe filter, meaning the user input is not escaped.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory snyk.io
- patch github.com
- web github.com