Cross-site Scripting (XSS) (CVE-2022-25303)

Summary

Cross-site Scripting (XSS)

Original description

The description as published by the source.

The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the flask.render_template function. However, the error_message is rendered using the | safe filter, meaning the user input is not escaped.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

References

advisory github.com
advisory nvd.nist.gov
advisory snyk.io
patch github.com
web github.com