{"action":"Upgrade fava to 1.22 or later.","affected":[{"fixed":"1.22","introduced":"0"}],"component":"fava","cve_ids":["CVE-2022-2514"],"ecosystem":"PyPI","epss":0.00874,"exploited":false,"fixed_versions":["1.22"],"ghsa_id":"GHSA-xrf4-39fm-j5f2","id":"tcs_01M5KGGQ9C5FPAXY6FV68P9FZE","modified_at":"2026-07-09T16:56:27.633784097Z","published_at":"2022-07-25T14:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-239","https://huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429","https://github.com/beancount/fava/commit/ca9e3882c7b5fbf5273ba52340b9fea6a99f3711","https://github.com/advisories/GHSA-xrf4-39fm-j5f2"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-239","url":"https://osv.dev/vulnerability/PYSEC-2022-239"}],"summary":"The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim."}