CVE-2011-1158: Cross-Site Scripting Vulnerability in feedparser
Summary
CVE-2011-1158: feedparser Cross-site Scripting vulnerability. Affects feedparser versions >= 5.0, < 5.0.1. Fixed in 5.0.1. How to fix ↓
Also tracked for
- feedparser · Debian:11
The same CVE-2011-1158 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is feedparser, an open-source Python library used for parsing RSS and Atom feeds. It provides a convenient way to extract and process data from these feed formats. The vulnerability affects versions 5.x before 5.0.1 of Universal Feed Parser, also known as feedparser or python-feedparser. This library is widely used in various Python applications that handle feed parsing functionality.
Vulnerability Detail
The vulnerability in feedparser.py allows for a cross-site scripting (XSS) attack. It occurs when an unexpected URI scheme is encountered, such as a javascript: URI. Remote attackers can exploit this vulnerability to inject arbitrary web script or HTML into the application. This can lead to various security risks, including the execution of malicious code in the context of the affected user's browser, potentially compromising sensitive information or performing unauthorized actions.
How To Fix
Minimum fixed version
5.0.1
This is the first release that contains the fix.
pip install --upgrade "feedparser==5.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to sanitize and validate user input before displaying it in web pages to prevent XSS attacks. This can be achieved by using appropriate encoding or escaping techniques, such as HTML entity encoding or using a secure templating engine that automatically escapes user input.
Conclusion
In conclusion, the feedparser package (Universal Feed Parser) versions 5.x before 5.0.1 is vulnerable to a cross-site scripting (XSS) attack. This can allow remote attackers to inject arbitrary web script or HTML into the application, potentially compromising user security. To mitigate this vulnerability, it is crucial to update the feedparser package to version 5.0.1 or later. Developers should also follow secure coding practices to prevent XSS attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for feedparser →
FAQ
The vulnerability allows remote attackers to inject arbitrary web script or HTML into the application, potentially leading to the execution of malicious code in the user's browser. This can result in various security risks, including information disclosure, session hijacking, or unauthorized actions.
Versions 5.x before 5.0.1 of Universal Feed Parser (feedparser or python-feedparser) are affected by this vulnerability.
While there may not be a specific known exploit for this vulnerability, the presence of an XSS vulnerability increases the risk of successful attacks. It is important to apply the recommended fix or update to mitigate the risk.
The recommended mitigation is to update the feedparser package to version 5.0.1 or later. Additionally, developers should follow secure coding practices, such as input validation and output encoding, to prevent XSS attacks.
Yes, this vulnerability is identified as CVE-2011-1158 and has a corresponding security advisory (GHSA-4m72-rmm9-2qjr).
Related vulnerabilities
Recent vulnerabilities recorded for feedparser.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
