CVE-2010-2970: Cross-Site Scripting (XSS) Vulnerabilities in MoinMoin
Summary
CVE-2010-2970: Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywiki... Affects moin versions >= 1.9, < 1.9.3. Fixed in 1.9.3. How to fix ↓
Also tracked for
- moin · Debian:10
The same CVE-2010-2970 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. MoinMoin version 1.9.x before 1.9.3 is affected by multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML into the application.
Vulnerability Detail
The identified vulnerabilities in MoinMoin 1.9.x before 1.9.3 are cross-site scripting (XSS) vulnerabilities. These vulnerabilities exist in the following components: action/SlideShow.py, action/anywikidraw.py, and action/language_setup.py. An attacker can exploit these vulnerabilities by injecting crafted content into the affected components. The injected script or HTML will then be executed in the context of the victim's browser, potentially leading to unauthorized actions or information disclosure. This vulnerability is similar to CVE-2010-2487.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.3
This is the first release that contains the fix.
pip install --upgrade "moin==1.9.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The identified vulnerabilities in MoinMoin 1.9.x before 1.9.3 are cross-site scripting (XSS) vulnerabilities that can be exploited by remote attackers. Upgrading to MoinMoin version 1.9.3 or later is recommended to address these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
The vulnerabilities allow attackers to inject malicious scripts or HTML into MoinMoin, potentially leading to cross-site scripting attacks. This can result in unauthorized actions, data theft, or the manipulation of content within the wiki.
No, only MoinMoin versions 1.9.x before 1.9.3 are affected. Upgrading to version 1.9.3 or later will resolve the vulnerabilities.
No specific workaround has been provided. It is recommended to upgrade to the latest version of MoinMoin to mitigate the vulnerabilities.
Yes, this vulnerability has been assigned the CVE identifier CVE-2010-2970.
You can find more information about this vulnerability in the MoinMoin advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/moin/PYSEC-2010-18.yaml
Related vulnerabilities
Recent vulnerabilities recorded for moin.
