PyPI/oncall CVE-2021-26722: unknown, EPSS 3.20%

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.

Action: Upgrade oncall to 1.4.1 or later.

pip install oncall==1.4.1

Affected

Fixed versions

Sources

• osv: PYSEC-2021-33
• https://github.com/linkedin/oncall/issues/341
• https://github.com/advisories/GHSA-rfw2-x9f8-2f6m

CVE-2021-26722 · published 2021-02-05T18:15:00Z · modified 2023-11-08T04:05:22.282119Z · JSON