{"action":"Upgrade wagtail to 2.7.4 or later.","affected":[{"fixed":"2.7.4","introduced":"2.7"},{"fixed":"2.9.3","introduced":"2.9"}],"component":"wagtail","cve_ids":["CVE-2020-15118"],"ecosystem":"PyPI","epss":0.01101,"exploited":false,"fixed_versions":["2.7.4","2.9.3"],"ghsa_id":"GHSA-2473-9hgq-j7xw","id":"tcs_01M5KG9KZ1AQAEGWTH9BT5GKN7","modified_at":"2023-11-08T04:02:29.793679Z","published_at":"2020-07-20T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-154","https://docs.wagtail.io/en/stable/reference/contrib/forms/index.html#usage","https://github.com/wagtail/wagtail/blob/master/docs/releases/2.9.3.rst","https://github.com/wagtail/wagtail/security/advisories/GHSA-2473-9hgq-j7xw","https://github.com/wagtail/wagtail/commit/d9a41e7f24d08c024acc9a3094940199df94db34","https://docs.djangoproject.com/en/3.0/ref/models/fields/#django.db.models.Field.help_text"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2020-154","url":"https://osv.dev/vulnerability/PYSEC-2020-154"},{"source":"nvd","source_id":"CVE-2020-15118","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15118"}],"summary":"In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard f"}