{"action":"Upgrade locust to 1.3.2 or later.","affected":[{"fixed":"1.3.2","introduced":"0"}],"component":"locust","cve_ids":["CVE-2020-28364"],"ecosystem":"PyPI","epss":0.00647,"exploited":false,"fixed_versions":["1.3.2"],"ghsa_id":"GHSA-vqxw-9pg7-v7v9","id":"tcs_01M5KGAS3MBWJ2G63QXZ07MZQ5","modified_at":"2026-06-10T17:00:34.618482475Z","published_at":"2020-11-09T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-60","https://docs.locust.io/en/stable/changelog.html","https://github.com/advisories/GHSA-vqxw-9pg7-v7v9"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-60","url":"https://osv.dev/vulnerability/PYSEC-2020-60"}],"summary":"A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users."}