GHSA-m4m5-j36m-8x72MediumCVSS 6.1
html injection vulnerability in the `tuitse_html` function.
🔗 CVE IDs covered (1)
📋 Description
Impact
When using tuitse_html without quoting the input, there is a html injection vulnerability. It should use the django version django.utils.html.format_html, instead of string.format()
Patches
Upgrade to version 1.3.2.
Workarounds
Sanitizing Taigi input with HTML quotation.
References
https://github.com/i3thuan5/TuiTse-TsuSin/pull/22
🎯 Affected products1
- pip/TuiTse-TsuSin:< 1.3.2
🔗 References (6)
- https://github.com/i3thuan5/TuiTse-TsuSin/security/advisories/GHSA-m4m5-j36m-8x72
- https://github.com/i3thuan5/TuiTse-TsuSin/pull/22
- https://nvd.nist.gov/vuln/detail/CVE-2024-23341
- https://github.com/i3thuan5/TuiTse-TsuSin/commit/9d21d99d7cfcd7c42aade251fab98ec102e730ea
- https://github.com/pypa/advisory-database/tree/main/vulns/tuitse-tsusin/PYSEC-2024-22.yaml
- https://github.com/advisories/GHSA-m4m5-j36m-8x72