CVE-2011-1157: Cross-Site Scripting (XSS) Vulnerability in feedparser
Summary
CVE-2011-1157: Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML c... Affects feedparser versions < 5.0.1. Fixed in 5.0.1. How to fix ↓
Also tracked for
- feedparser · Debian:11
The same CVE-2011-1157 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Universal Feed Parser, also known as feedparser or python-feedparser, is a Python library used for parsing syndicated feeds. It provides a convenient way to extract and process data from various feed formats such as RSS and Atom. The library is widely used in Python applications that handle feed data.
Vulnerability Detail
The vulnerability identified as CVE-2011-1157 is a cross-site scripting (XSS) vulnerability in the feedparser.py module of Universal Feed Parser. It affects versions 5.x before 5.0.1. The vulnerability allows remote attackers to inject arbitrary web script or HTML by exploiting malformed XML comments. This can lead to the execution of malicious code in the context of a user's browser, potentially compromising the confidentiality and integrity of user data.
How To Fix
Minimum fixed version
5.0.1
This is the first release that contains the fix.
pip install --upgrade "feedparser==5.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The cross-site scripting vulnerability in Universal Feed Parser (feedparser) can be mitigated by upgrading to version 5.0.1 or later. This upgrade ensures proper handling of XML comments, preventing the injection of malicious scripts or HTML. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for feedparser →
FAQ
Universal Feed Parser is a Python library used for parsing syndicated feeds such as RSS and Atom.
The vulnerability allows remote attackers to inject malicious scripts or HTML, potentially compromising user data and browser security.
Versions 5.x before 5.0.1 are affected by this vulnerability.
To fix this vulnerability, upgrade to Universal Feed Parser version 5.0.1 or later.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for feedparser.
