CVE-2009-2959: Cross-Site Scripting (XSS) Vulnerability in Buildbot
Summary
CVE-2009-2959: Cross-site scripting (XSS) vulnerability in the waterfall web status view (status/web/waterfall.py) in Buildbot 0.7.6 through 0.7.11p1 allows remote attackers to inject arbitrary web script or HTML via unspecified vector... Affects buildbot versions >= 0.7.6, < 0.7.12. Fixed in 0.7.12. How to fix ↓
Also tracked for
- buildbot · Debian:11
The same CVE-2009-2959 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildbot is an open-source continuous integration framework written in Python. It provides automation and monitoring of software build, test, and release processes. The vulnerability affects versions 0.7.6 through 0.7.11p1 of Buildbot. The waterfall web status view (status/web/waterfall.py) is susceptible to a cross-site scripting (XSS) attack, which allows remote attackers to inject arbitrary web script or HTML into the application.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in Buildbot's waterfall web status view allows attackers to inject malicious web script or HTML into the application. This can lead to various security risks, such as session hijacking, defacement of web pages, or stealing sensitive user information. The specific vectors through which the attack can be carried out are unspecified in the vulnerability details.
How To Fix
Latest published version: 4.3.0 as of 22 Oct 2026
pip install --upgrade "buildbot==4.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.12
This is the first release that contains the fix.
pip install --upgrade "buildbot==0.7.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround is mentioned in the vulnerability details.
Conclusion
The cross-site scripting (XSS) vulnerability in Buildbot's waterfall web status view can allow remote attackers to inject malicious web script or HTML into the application. To mitigate this vulnerability, users should update their Buildbot installation to version 0.7.12 or a later release. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buildbot →
FAQ
Buildbot is an open-source continuous integration framework written in Python. It automates and monitors software build, test, and release processes.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking or stealing sensitive information.
The XSS vulnerability in Buildbot's waterfall web status view allows remote attackers to inject arbitrary web script or HTML into the application. This can lead to security risks, such as unauthorized access to user sessions or defacement of web pages.
Yes, the vulnerability has been fixed in Buildbot version 0.7.12. Users are advised to update their installation to this version or a later release.
No specific workarounds are mentioned in the vulnerability details. It is recommended to update to a fixed version of Buildbot.
Related vulnerabilities
Recent vulnerabilities recorded for buildbot.
