-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from unescaped error messages containing user-supplied parameters. The format_errormsg function in template_filters.py was responsible for processing these messages and returning HTML links. Prior to the patch, it returned raw strings that were rendered with the |safe filter in errors.html, bypassing escaping. The commit explicitly replaced string returns with Markup wrappers and removed |safe usage in templates, confirming this function's role in the XSS vector.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fava | pip | >= 0, < 1.22 | 1.22 |
KEV Misses 88% of Exploited CVEs- Get the report