CVE-2023-26131

Go/github.com/xyproto/algernon CVE-2023-26131: medium 6.1, EPSS 0.69%

Algernon engine and themes vulnerable to Cross-site Scripting

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-g47h-fgcw-g4ph
• https://nvd.nist.gov/vuln/detail/CVE-2023-26131
• https://github.com/xyproto/algernon
• https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/engine/handlers.go#L512
• https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/engine/handlers.go#L514
• https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/themes/html.go#L145
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONENGINE-3312111
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONTHEMES-3312112

CVE-2023-26131 · published 2023-05-31T06:30:39Z · modified 2023-11-08T04:11:59.253746Z · JSON