Vulnerability · Published Feb 29, 2024 · Assigned by GitHub_M
CVE-2024-27290Docassemble HTML and javascript injection
Medium 6.1
In plain English
A medium-severity cross-site scripting in docassemble from jhpyle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The vulnerability has been patched in version 1.4.97 of the master branch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | docassemble-webapp | 1.4.97 | GHSA-pcfx-g2j2-f6f6 |
| PyPI | docassemble-webapp | 1.4.97 | PYSEC-2026-1311 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jhpyle | docassemble | < 1.4.97 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N