CVE-2021-39286

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped

published August 18, 2021

CVSS
—
EPSS
1%
Percentile
52.6
In the wild
Unconfirmed
What it is

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00699 · 52.6th percentile
Published
2021-08-18T17:31Z
EPSS history
Timeline
  • 18 AUG 17:31Z
    Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped
    cvelistv5