https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 03:25:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-57368 EUVD-2026-57368 https://cve.radiocsirt.org/vuln/euvd-2026-57368 https://cve.radiocsirt.org/vuln/fkie_cve-2019-15782 <p>WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.</p> <p>WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-15782 https://cve.radiocsirt.org/vuln/ghsa-gjh4-fcv3-whpq <p><strong>Affected:</strong> npm: webtorrent</p> <p>Versions of `webtorrent` prior to 0.107.6 are vulnerable to Cross-Site Scripting. `webtorrent` servers started with `torrent.createServer()` lists a torrent&#39;s title and files in the index page without sanitization. This allows attackers to execute arbitrary JavaScript in the victim&#39;s browser through files with names containing the malicious payload. The issue is mitigated due to the fact that the server only allows fetching data pieces from the torrent.</p> <p>## Recommendation</p> <p>Upgrade to version 0.107.6 or later.</p> <p><strong>Affected:</strong> npm: webtorrent</p> <p>Versions of `webtorrent` prior to 0.107.6 are vulnerable to Cross-Site Scripting. `webtorrent` servers started with `torrent.createServer()` lists a torrent&#39;s title and files in the index page without sanitization. This allows attackers to execute arbitrary JavaScript in the victim&#39;s browser through files with names containing the malicious payload. The issue is mitigated due to the fact that the server only allows fetching data pieces from the torrent.</p> <p>## Recommendation</p> <p>Upgrade to version 0.107.6 or later.</p> https://cve.radiocsirt.org/vuln/ghsa-gjh4-fcv3-whpq https://cve.radiocsirt.org/vuln/gsd-2019-15782 gsd-2019-15782 https://cve.radiocsirt.org/vuln/gsd-2019-15782