CVE-2009-5065: Cross-Site Scripting (XSS) Vulnerability in feedparser
Summary
CVE-2009-5065: Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nes... Affects feedparser versions < 5.0. Fixed in 5.0. How to fix ↓
Also tracked for
- feedparser · Debian:11
The same CVE-2009-5065 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Universal Feed Parser (aka feedparser or python-feedparser) is a Python library used for parsing syndicated feeds. It provides a convenient way to extract and process data from various feed formats. However, versions before 5.0 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability exists in the feedparser.py file of Universal Feed Parser. It allows remote attackers to inject arbitrary web script or HTML through vectors involving nested CDATA stanzas. This can lead to the execution of malicious code in the context of a user's browser, potentially compromising their sensitive information or performing unauthorized actions.
How To Fix
Minimum fixed version
5.0
This is the first release that contains the fix.
pip install --upgrade "feedparser==5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to sanitize user input before processing it with the feedparser library. This can be done by using a HTML sanitizer library or implementing custom input validation and filtering mechanisms.
Conclusion
The cross-site scripting (XSS) vulnerability in Universal Feed Parser (feedparser) before version 5.0 can allow remote attackers to inject malicious scripts or HTML code. To mitigate this vulnerability, it is crucial to upgrade to the latest version of the package. If immediate upgrade is not possible, sanitizing user input before processing it with the library can serve as a temporary workaround. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for feedparser →
FAQ
Universal Feed Parser is a Python library used for parsing syndicated feeds. It provides a unified interface to handle various feed formats.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the context of the victim's browser.
The XSS vulnerability in feedparser is caused by inadequate input sanitization. Attackers can exploit this by injecting malicious scripts or HTML code into nested CDATA stanzas within syndicated feeds.
Exploiting this vulnerability can allow attackers to steal sensitive information, such as login credentials or personal data, from users who view the compromised feed. It can also be used to perform unauthorized actions on behalf of the user.
Yes, upgrading to Universal Feed Parser version 5.0 or later fixes the XSS vulnerability. It is recommended to update the package as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for feedparser.
