CVE-2017-5934: Cross-Site Scripting (XSS) Vulnerability in MoinMoin
Summary
CVE-2017-5934: Moderate severity vulnerability that affects moin. Affects moin versions < 1.9.10. Fixed in 1.9.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. MoinMoin allows users to create and manage web pages, making it a popular choice for knowledge sharing and documentation purposes. However, an XSS vulnerability has been discovered in the link dialogue of the GUI editor in MoinMoin versions prior to 1.9.10.
Vulnerability Detail
The vulnerability, identified as CVE-2017-5934, enables remote attackers to inject arbitrary web script or HTML into MoinMoin. By exploiting this vulnerability, an attacker can execute malicious code within the context of the affected user's browser. This can lead to various security issues, including session hijacking, defacement of web pages, and theft of sensitive information.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.10
This is the first release that contains the fix.
pip install --upgrade "moin==1.9.10"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can implement a temporary workaround by disabling the affected functionality. In this case, the link dialogue in the GUI editor should be disabled or removed to prevent the exploitation of the XSS vulnerability. Here is an example of how to disable the link dialogue in MoinMoin:
# Disable the link dialogue
config.disable_link_dialogue = True
Conclusion
In conclusion, the CVE-2017-5934 vulnerability in MoinMoin exposes users to the risk of cross-site scripting attacks. It is crucial to upgrade to version 1.9.10 or later to mitigate this vulnerability. If immediate upgrade is not possible, disabling the link dialogue can provide temporary protection. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
The vulnerability allows remote attackers to inject malicious code into MoinMoin, potentially leading to session hijacking, defacement of web pages, and theft of sensitive information.
The vulnerability affects MoinMoin versions prior to 1.9.10.
While there may not be a specific known exploit for this vulnerability, it is important to address it promptly to prevent potential security breaches.
The recommended mitigation is to upgrade to MoinMoin version 1.9.10 or later. If immediate upgrade is not possible, disabling the link dialogue in the GUI editor can serve as a temporary workaround.
For more information about this vulnerability, you can refer to the official CVE-2017-5934 entry or consult the MoinMoin documentation and community resources.
Related vulnerabilities
Recent vulnerabilities recorded for moin.
