Most recent entries from all

bdu:2025-04172

BREW-alot-CVE-2024-41810 — Twisted vulnerable to HTML injection in HTTP redirect body

Affected: Homebrew: alot

### Summary

The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body.

### Details Twisted’s `redirectTo` function generates an `HTTP 302 Redirect` response. The response contains an HTML body, built for exceptional cases where the browser doesn’t properly handle the redirect, allowing the user to click a link, navigating them to the specified destination.

The function reflects the destination URL in the HTML body without any output encoding. ```python # https://github.com/twisted/twisted/blob/trunk/src/twisted/web/_template_util.py#L88 def redirectTo(URL: bytes, request: IRequest) -> bytes: # ---snip--- content = b""" <html> <head> <meta http-equiv=\"refresh\" content=\"0;URL=%(url)s\"> </head> <body bgcolor=\"#FFFFFF\" text=\"#000000\"> <a href=\"%(url)s\">click here</a> </body> </html> """ % { b"url": URL } return content ```

If an attacker has full or partial control over redirect location due to an application bug, also known as an “Open Redirect”, they may inject arbitrary HTML into the response’s body, ultimately leading to an XSS attack.

It’s worth noting that the issue is known to maintainers and tracked with GitHub [Issue#9839](https://github.com/twisted/twisted/issues/9839). The issue description, however, does…

EUVD-2026-258653

fkie_cve-2024-41810

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.

GHSA-cf56-g6w6-pqq2 — Twisted vulnerable to HTML injection in HTTP redirect body

Affected: PyPI: twisted

### Summary

It’s worth noting that the issue is known to maintainers and tracked with GitHub [Issue#9839](https://github.com/twisted/twisted/issues/9839). The issue description, however, does…

msrc_CVE-2024-41810 — HTML injection in HTTP redirect body

msrc_CVE-2024-41810

OESA-2024-1983 — python-twisted security update

Affected: openEuler:24.03-LTS: python-twisted

Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fix(es): Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41671) Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41810)

openSUSE-SU-2024:14236-1 — python-Twisted-doc-24.3.0-2.1 on GA media

python-Twisted-doc-24.3.0-2.1 on GA media

PYSEC-2024-75

Affected: PyPI: twisted

RHSA-2024:7312 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

djangorestframework: Cross-site Scripting (XSS) via break_long_headers urllib3: proxy-authorization request header is not stripped during cross-origin redirects python-twisted: Reflected XSS via HTML Injection in Redirect Response

SUSE-SU-2024:2732-1 — Security update for python-Twisted

Security update for python-Twisted

UBUNTU-CVE-2024-41810

Affected: Ubuntu:Pro:14.04:LTS: twisted, Ubuntu:Pro:16.04:LTS: twisted, Ubuntu:Pro:18.04:LTS: twisted, Ubuntu:20.04:LTS: twisted, Ubuntu:22.04:LTS: twisted, Ubuntu:24.04:LTS: twisted

WID-SEC-W-2024-2229 — Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder vertrauliche Informationen offenzulegen.