Insufficient HTML Sanitization in inventree
Summary
GHSA-rm89-9g65-4ffr: Insufficient HTML Sanitization. Affects inventree versions < 0.7.2. Fixed in 0.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Inventree is an open-source inventory management system written in Python. It allows users to track stock levels, manage parts and assemblies, and generate reports. The system relies on a database to store and retrieve data, which is then rendered on the front-end for users to interact with. However, the system is vulnerable to insufficient HTML sanitization, which can lead to the injection of malicious JavaScript code by authenticated users. This vulnerability arises from a lack of proper sanitation of database fields and the absence of HTML escaping when rendering data on the front end.
Vulnerability Detail
The vulnerability allows authenticated users to inject un-sanitized HTML into various front-end views. This can result in the execution of malicious JavaScript code in the user's browser. The attack vector is limited to authenticated users who have the ability to write data to the database. However, it is still a serious vulnerability that needs to be addressed. The proposed patch for this vulnerability prevents the injection of un-escaped fields into front-end UI elements. A future patch will also address the sanitization of database fields on the back end, but this will require significant refactoring of multiple database tables.
How To Fix
Minimum fixed version
0.7.2
This is the first release that contains the fix.
pip install --upgrade "inventree==0.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. Users are strongly advised to upgrade to a patched version of Inventree.
Conclusion
The insufficient HTML sanitization vulnerability in Inventree can allow authenticated users to inject malicious JavaScript code into the user's browser. It is recommended that users upgrade to the patched versions (0.8.0 or 0.7.2) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for inventree →
FAQ
Inventree is an open-source inventory management system written in Python. It allows users to track stock levels, manage parts and assemblies, and generate reports.
Any users of Inventree versions prior to 0.8.0 or 0.7.2 are potentially affected by this vulnerability.
The vulnerability allows authenticated users to inject un-sanitized HTML into various front-end views, potentially leading to the execution of malicious JavaScript code in the user's browser.
No, there are no known workarounds for this vulnerability. Users should upgrade to a patched version of Inventree.
To upgrade to a patched version, users can follow the instructions provided in the release notes of the 0.8.0 or 0.7.2 release.
References
Related vulnerabilities
Recent vulnerabilities recorded for inventree.
