CVE-2012-6082: Cross-Site Scripting (XSS) in MoinMoin
Summary
CVE-2012-6082: Cross-site scripting (XSS) vulnerability in the rsslink function in theme/init.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link. Affects moin versions < 1.9.6. Fixed in 1.9.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. The vulnerability in question affects MoinMoin version 1.9.5. MoinMoin allows users to create RSS links for specific pages. However, the rsslink function in the theme/init.py file does not properly sanitize user input, leading to a cross-site scripting (XSS) vulnerability. This vulnerability enables remote attackers to inject arbitrary web script or HTML into the page name of an RSS link.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in MoinMoin version 1.9.5 arises from the lack of input sanitization in the rsslink function. By exploiting this vulnerability, an attacker can inject malicious code into the page name of an RSS link. When unsuspecting users access the affected page and interact with the RSS link, the injected code executes within their browser, potentially leading to various malicious activities such as session hijacking, data theft, or defacement of the website.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.6
This is the first release that contains the fix.
pip install --upgrade "moin==1.9.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually sanitizing user input before passing it to the rsslink function. This can be achieved by using appropriate input validation and sanitization techniques, such as HTML entity encoding or using a secure HTML parsing library.
Conclusion
The cross-site scripting (XSS) vulnerability in MoinMoin version 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in an RSS link. To mitigate this vulnerability, it is crucial to upgrade to MoinMoin version 1.9.6 or later. Alternatively, a temporary workaround can be implemented by properly sanitizing user input before passing it to the rsslink function. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
The vulnerability allows remote attackers to inject malicious code into the page name of an RSS link, potentially leading to cross-site scripting attacks. This can result in various security risks, including session hijacking, data theft, or website defacement.
You can use the Vulert Playground at Vulert Scanner to check if your MoinMoin installation is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities, including this XSS vulnerability.
Yes, the developers of MoinMoin have released a patch in version 1.9.6. It is recommended to upgrade to this version or later to fix the vulnerability.
There have been reported instances of this vulnerability being exploited in the wild. It is crucial to promptly apply the necessary fixes to mitigate the risk of exploitation.
While upgrading to the latest version is the recommended solution, you can implement a temporary workaround by manually sanitizing user input before passing it to the rsslink function. However, this is not a foolproof solution, and upgrading to the patched version is highly advised.
Related vulnerabilities
Recent vulnerabilities recorded for moin.
