CVE-2024-23341CWE-79

TuiTse-TsuSin html injection vulnerability in `tuitse_html` function

Medium · published January 23, 2024

CVSS v3.1
6.1
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using `tuitse_html` without quoting the input, there is a html injection vulnerability. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input with HTML quotation.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-01-23T17:22Z
EPSS history
Timeline
  • 23 JAN 17:22Z
    TuiTse-TsuSin html injection vulnerability in `tuitse_html` function
    cvelistv5