PyPI/wagtail CVE-2020-15118: unknown, EPSS 1.10%
In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard f
Action: Upgrade wagtail to 2.7.4 or later.
pip install wagtail==2.7.4pip install wagtail==2.9.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.7 | 2.7.4 | - |
| 2.9 | 2.9.3 | - |
Fixed versions
| 2.7.4 | 2.9.3 |
Sources
- osv: PYSEC-2020-154
- https://docs.wagtail.io/en/stable/reference/contrib/forms/index.html#usage
- https://github.com/wagtail/wagtail/blob/master/docs/releases/2.9.3.rst
- https://github.com/wagtail/wagtail/security/advisories/GHSA-2473-9hgq-j7xw
- https://github.com/wagtail/wagtail/commit/d9a41e7f24d08c024acc9a3094940199df94db34
- https://docs.djangoproject.com/en/3.0/ref/models/fields/#django.db.models.Field.help_text
CVE-2020-15118 · published · modified · JSON