CVE-2011-1058: Cross-Site Scripting (XSS) in MoinMoin
Summary
CVE-2011-1058: Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbi... Affects moin versions < 1.9.3. Fixed in 1.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. The vulnerability affects MoinMoin versions prior to 1.9.3 when the docutils library is installed or when the "format rst" option is set. The reStructuredText (rst) parser in MoinMoin is susceptible to a cross-site scripting (XSS) attack. This type of vulnerability allows remote attackers to inject arbitrary web script or HTML into the application.
Vulnerability Detail
The vulnerability arises from the handling of the refuri attribute in the rst parser. Attackers can exploit this by injecting a javascript: URL into the refuri attribute, which will then be executed when the vulnerable page is viewed by a user. This can lead to various consequences, including the theft of sensitive information, session hijacking, or the delivery of malicious content to unsuspecting users.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.3
This is the first release that contains the fix.
pip install --upgrade "moin==1.9.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the "format rst" option in the MoinMoin configuration. This can be done by modifying the configuration file or through the administrative interface. By disabling this option, the vulnerable code path is not triggered, reducing the risk of exploitation.
Conclusion
The CVE-2011-1058 vulnerability in MoinMoin exposes the application to cross-site scripting attacks. Upgrading to version 1.9.3 or later is the recommended solution. If immediate upgrade is not possible, disabling the "format rst" option can serve as a temporary workaround. Stay vigilant and apply the necessary security measures to protect your MoinMoin installation.
See every vulnerability recorded for moin →
FAQ
The vulnerability allows attackers to inject malicious scripts or HTML into MoinMoin pages, potentially leading to the execution of arbitrary code in the context of the user's browser. This can result in various attacks, such as stealing sensitive information or performing actions on behalf of the user.
No, authentication is not required. The vulnerability can be exploited by any remote attacker who can access the vulnerable MoinMoin instance.
There have been reports of this vulnerability being actively exploited in the past. It is crucial to apply the necessary patches or upgrades to protect against potential attacks.
Input validation alone is not sufficient to mitigate this vulnerability. It is recommended to apply the provided patches or upgrade to the latest version of MoinMoin.
For more information about this vulnerability, you can refer to the official advisory provided by the MoinMoin project. Additionally, you can reach out to info@devnack.com for further support on vulnerability remediation.
Related vulnerabilities
Recent vulnerabilities recorded for moin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
