CVE-2010-2969: Cross-Site Scripting (XSS) Vulnerabilities in MoinMoin
Summary
CVE-2010-2969: Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePage... Affects moin versions >= 1.9, < 1.9.3. Fixed in 1.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. MoinMoin versions 1.7.3 and earlier, as well as 1.9.x before 1.9.3, are affected by multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML into the application.
Vulnerability Detail
The identified vulnerabilities in MoinMoin are caused by insufficient input sanitization in various modules, including action/LikePages.py, action/chart.py, and action/userprofile.py. Attackers can exploit these vulnerabilities by crafting malicious content and submitting it to the affected modules. When the content is rendered, the injected script or HTML is executed in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious activities.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.3
This is the first release that contains the fix.
pip install --upgrade "moin==1.9.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for these vulnerabilities. Upgrading to the patched version is the recommended solution.
Conclusion
MoinMoin versions 1.7.3 and earlier, as well as 1.9.x before 1.9.3, are vulnerable to cross-site scripting (XSS) attacks. Upgrading to version 1.9.3 or later is recommended to mitigate these vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
These vulnerabilities allow attackers to execute arbitrary scripts or HTML code in the context of a victim's browser. This can lead to various malicious activities, including session hijacking, defacement, and data theft.
No, only MoinMoin versions 1.7.3 and earlier, as well as 1.9.x before 1.9.3, are affected. Upgrading to version 1.9.3 or later resolves the vulnerabilities.
There is no specific information available regarding active exploits targeting these vulnerabilities. However, it is always recommended to apply security patches promptly to mitigate potential risks.
Yes, these vulnerabilities can be exploited remotely by attackers who can submit crafted content to the affected modules.
There is no publicly available proof-of-concept or exploit code provided at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for moin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
