CVE-2016-7146: MoinMoin 1.9.8 JavaScript Injection Vulnerability
Summary
CVE-2016-7146: MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=fckdialog&dialog... Affects moin versions < 1.9.9. Fixed in 1.9.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. MoinMoin 1.9.8 is a specific version of the software that is susceptible to a JavaScript injection vulnerability.
Vulnerability Detail
The vulnerability in MoinMoin 1.9.8 allows remote attackers to conduct JavaScript injection attacks. This can be achieved by utilizing the 'page creation or crafted URL' approach, specifically targeting the 'action=fckdialog&dialog=attachment' component via the page name parameter. The vulnerability is categorized as a Cross-Site Scripting (XSS) issue. Exploiting this vulnerability can lead to unauthorized execution of arbitrary JavaScript code in the context of the affected user's browser, potentially enabling various malicious activities.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.9
This is the first release that contains the fix.
pip install --upgrade "moin==1.9.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to follow the recommended fix and upgrade to a patched version of MoinMoin.
Conclusion
The JavaScript injection vulnerability in MoinMoin 1.9.8 can be exploited by remote attackers to execute arbitrary JavaScript code. To mitigate this risk, users should upgrade to MoinMoin version 1.9.9 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
MoinMoin is an open-source wiki engine written in Python that allows collaborative content creation and editing.
Exploiting this vulnerability can result in the execution of arbitrary JavaScript code in the context of the affected user's browser, potentially leading to various malicious activities.
To fix this vulnerability, it is recommended to upgrade to MoinMoin version 1.9.9 or later.
No specific workaround has been provided for this vulnerability. It is advised to upgrade to a patched version of MoinMoin.
For more information about this vulnerability, you can refer to the official advisory at https://github.com/pypa/advisory-database/blob/main/vulns/moin/PYSEC-2016-30.yaml
Related vulnerabilities
Recent vulnerabilities recorded for moin.
