https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 16:06:37 +0000 https://cve.radiocsirt.org/vuln/cve-2026-40353 <p><strong>Affected:</strong> wger-project wger</p> <p>wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields (such as license_author) without escaping, and templates render the result using Django&#39;s |safe filter. An authenticated user can create an ingredient with a malicious license_author value containing JavaScript, which executes in the browser of any visitor viewing the ingredient page, resulting in stored XSS. This issue has been fixed in version 2.5.</p> <p><strong>Affected:</strong> wger-project wger</p> <p>wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields (such as license_author) without escaping, and templates render the result using Django&#39;s |safe filter. An authenticated user can create an ingredient with a malicious license_author value containing JavaScript, which executes in the browser of any visitor viewing the ingredient page, resulting in stored XSS. This issue has been fixed in version 2.5.</p> https://cve.radiocsirt.org/vuln/cve-2026-40353 https://cve.radiocsirt.org/vuln/pysec-2026-3419 <p><strong>Affected:</strong> PyPI: wger</p> <p># Stored XSS via Unescaped License Attribution Fields</p> <p>## Summary</p> <p>The `AbstractLicenseModel.attribution_link` property in `wger/utils/models.py` constructs HTML strings by directly interpolating user-controlled fields (`license_author`, `license_title`, `license_object_url`, `license_author_url`, `license_derivative_source_url`) without any escaping. The resulting HTML is rendered in the ingredient view template using Django&#39;s `|safe` filter, which disables auto-escaping. An authenticated user can create an ingredient with a malicious `license_author` value containing JavaScript, which executes when any user (including unauthenticated visitors) views the ingredient page.</p> <p>## Severity</p> <p>**High** (CVSS 3.1: ~7.6)</p> <p>- Low-privilege attacker (any authenticated non-temporary user) - Stored XSS — persists in database - Triggers on a public page (no authentication needed to view) - Can steal session cookies, perform actions as other users, redirect to phishing</p> <p>## CWE</p> <p>CWE-79: Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;)</p> <p>## Affected Components</p> <p>### Vulnerable Property **File:** `wger/utils/models.py:88-110`</p> <p>```python @property def attribution_link(self): out = &#39;&#39; if self.license_object_url: out += f&#39;&lt;a href=&#34;{self.license_object_url}&#34;&gt;{self.license_title}&lt;/a&gt;&#39; else: out += self.license_title # NO ESCAPING out += &#39; by &#39; if self.license_author_url: out += f&#39;&lt;a href=&#34;{self.license_author_url}&#34;&gt;{self.…</p> <p><strong>Affected:</strong> PyPI: wger</p> <p># Stored XSS via Unescaped License Attribution Fields</p> <p>## Summary</p> <p>The `AbstractLicenseModel.attribution_link` property in `wger/utils/models.py` constructs HTML strings by directly interpolating user-controlled fields (`license_author`, `license_title`, `license_object_url`, `license_author_url`, `license_derivative_source_url`) without any escaping. The resulting HTML is rendered in the ingredient view template using Django&#39;s `|safe` filter, which disables auto-escaping. An authenticated user can create an ingredient with a malicious `license_author` value containing JavaScript, which executes when any user (including unauthenticated visitors) views the ingredient page.</p> <p>## Severity</p> <p>**High** (CVSS 3.1: ~7.6)</p> <p>- Low-privilege attacker (any authenticated non-temporary user) - Stored XSS — persists in database - Triggers on a public page (no authentication needed to view) - Can steal session cookies, perform actions as other users, redirect to phishing</p> <p>## CWE</p> <p>CWE-79: Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;)</p> <p>## Affected Components</p> <p>### Vulnerable Property **File:** `wger/utils/models.py:88-110`</p> <p>```python @property def attribution_link(self): out = &#39;&#39; if self.license_object_url: out += f&#39;&lt;a href=&#34;{self.license_object_url}&#34;&gt;{self.license_title}&lt;/a&gt;&#39; else: out += self.license_title # NO ESCAPING out += &#39; by &#39; if self.license_author_url: out += f&#39;&lt;a href=&#34;{self.license_author_url}&#34;&gt;{self.…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3419