PyPI/rucio-webui CVE-2026-25736: medium 6.1, EPSS 0.53%
Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute
Action: Upgrade rucio-webui to 35.8.3 or later.
pip install rucio-webui==35.8.3pip install rucio-webui==38.5.4pip install rucio-webui==39.3.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 35.8.3 | - |
| 36.0.0rc1 | 38.5.4 | - |
| 39.0.0rc1 | 39.3.1 | - |
Fixed versions
| 35.8.3 | 38.5.4 | 39.3.1 |
Sources
- osv: GHSA-fq4f-4738-rqxm
- https://github.com/rucio/rucio/security/advisories/GHSA-fq4f-4738-rqxm
- https://nvd.nist.gov/vuln/detail/CVE-2026-25736
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
- https://github.com/rucio/rucio
- https://github.com/rucio/rucio/releases/tag/35.8.3
- https://github.com/rucio/rucio/releases/tag/38.5.4
- https://github.com/rucio/rucio/releases/tag/39.3.1
CVE-2026-25736 · published · modified · JSON