CVE-2011-1158: Cross-Site Scripting (XSS) Vulnerability in feedparser
Summary
CVE-2011-1158: Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected U... Affects feedparser versions < 5.0.1. Fixed in 5.0.1. How to fix ↓
Also tracked for
- feedparser · Debian:11
The same CVE-2011-1158 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
feedparser is a Python library that parses RSS and Atom feeds. It is widely used to extract and process data from various web feeds. The library provides a convenient interface for developers to work with feed data in their Python applications. However, versions 5.x before 5.0.1 of feedparser are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in feedparser allows remote attackers to inject arbitrary web script or HTML through an unexpected URI scheme. This can be exploited by crafting a malicious feed that includes a javascript: URI. When the feed is parsed by feedparser, the injected script or HTML will be executed in the context of the user's browser, potentially leading to unauthorized actions or information disclosure.
How To Fix
Minimum fixed version
5.0.1
This is the first release that contains the fix.
pip install --upgrade "feedparser==5.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version of feedparser as soon as possible.
Conclusion
The cross-site scripting vulnerability in feedparser (CVE-2011-1158) allows attackers to inject malicious scripts or HTML into feeds, potentially leading to unauthorized actions or information disclosure. To mitigate this risk, it is crucial to upgrade to feedparser version 5.0.1 or later. There is no known workaround for this vulnerability. For additional support, please contact DevNack.com.
See every vulnerability recorded for feedparser →
FAQ
The vulnerability allows attackers to inject malicious scripts or HTML into feeds, which can be executed by users' browsers. This can lead to various attacks, such as stealing sensitive information or performing unauthorized actions on behalf of the user.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
While specific exploits targeting this vulnerability may exist, they have not been disclosed in the public domain. However, it is important to patch the vulnerability as soon as possible to mitigate the risk of potential attacks.
Yes, this vulnerability has been assigned the CVE identifier CVE-2011-1158.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability in your application.
Related vulnerabilities
Recent vulnerabilities recorded for feedparser.
