Cross-Site Scripting Vulnerability in Flower
Summary
GHSA-94ww-22rx-493x: Cross-Site Scripting. Affects flower versions < 0.9.2. Fixed in 0.9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flower is a Python package available on PyPI that provides a web-based monitoring and administration interface for Celery, a distributed task queue system. It allows users to view task progress, monitor worker status, and manage tasks. However, Flower versions prior to 0.9.2 are vulnerable to a Cross-Site Scripting (XSS) attack on the tasks page. This vulnerability arises due to improper data escaping, which allows an attacker to inject malicious scripts into the page.
Vulnerability Detail
The Cross-Site Scripting vulnerability in Flower allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various security issues, including session hijacking, defacement of the application, and theft of sensitive information. The vulnerability originates from the lack of proper input sanitization and output encoding, which enables an attacker to inject malicious code that is executed by unsuspecting users visiting the affected tasks page.
How To Fix
Latest published version: 2.2.0 as of 23 Oct 2026
pip install --upgrade "flower==2.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.2
This is the first release that contains the fix.
pip install --upgrade "flower==0.9.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually escaping the data before rendering it on the tasks page. This can be achieved by using appropriate encoding functions provided by the framework or template engine being used. Here is an example using the Django template engine:
{{ data|escape }}
Conclusion
The Cross-Site Scripting vulnerability in Flower versions prior to 0.9.2 can be exploited by attackers to execute arbitrary JavaScript code in the context of a victim's browser. Upgrading to the latest version or applying the recommended workaround is crucial to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flower →
FAQ
Flower is a web-based monitoring and administration interface for Celery, a distributed task queue system. It provides real-time monitoring of task progress, worker status, and allows task management.
Cross-Site Scripting is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking, defacement, and data theft.
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to unauthorized access, data theft, and manipulation of the Flower application.
Yes, the vulnerability has been fixed in Flower version 0.9.2. It is recommended to upgrade to this version or later to ensure protection against Cross-Site Scripting attacks.
Yes, if immediate upgrading is not possible, a temporary workaround can be implemented by manually escaping the data before rendering it on the tasks page. This involves using appropriate encoding functions provided by the framework or template engine being used.
References
Related vulnerabilities
Recent vulnerabilities recorded for flower.
