CVE-2016-7148: MoinMoin 1.9.8 JavaScript Injection Vulnerability
Summary
CVE-2016-7148: MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=AttachFile (via page name) comp... Affects moin versions < 1.9.9. Fixed in 1.9.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. MoinMoin 1.9.8 is a specific version of the software that is vulnerable to a JavaScript injection attack. This vulnerability allows remote attackers to exploit the 'page creation' approach, specifically the action=AttachFile component, to conduct Cross-Site Scripting (XSS) attacks. By injecting malicious JavaScript code, an attacker can execute arbitrary code within the context of the affected user's browser.
Vulnerability Detail
The vulnerability in MoinMoin 1.9.8 arises from a lack of proper input sanitization in the 'page creation' functionality. When a user creates a new page and attaches a file to it, the page name is not properly validated or sanitized. This allows an attacker to inject malicious JavaScript code into the page name, which is then executed when the page is viewed by other users. The impact of this vulnerability can range from stealing sensitive information, such as login credentials, to performing actions on behalf of the user within the application.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.9
This is the first release that contains the fix.
pip install --upgrade "moin==1.9.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing the page names before allowing them to be created. This can be done by implementing input validation and sanitization routines that strip out any potentially malicious JavaScript code from the page names. Here is an example of how this can be achieved in Python:
import re
def sanitize_page_name(page_name):
# Remove any JavaScript code
sanitized_name = re.sub(r'<script.*?>.*?</script>', '', page_name)
return sanitized_name
Conclusion
The MoinMoin 1.9.8 JavaScript injection vulnerability (CVE-2016-7148) allows remote attackers to conduct Cross-Site Scripting (XSS) attacks by injecting malicious JavaScript code into page names. This can lead to the execution of arbitrary code within the context of the affected user's browser. To mitigate this vulnerability, it is recommended to upgrade to MoinMoin version 1.9.9 or later. If immediate upgrade is not possible, implementing a manual page name validation and sanitization routine can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
The vulnerability allows remote attackers to inject malicious JavaScript code into MoinMoin pages, potentially leading to Cross-Site Scripting (XSS) attacks. This can result in the theft of sensitive information or unauthorized actions within the application.
You can use the Vulert playground at Vulert Scanner to check if your MoinMoin installation is affected by this vulnerability. Simply enter your Pipfile.lock file and the playground will analyze it for any known vulnerabilities.
Yes, the vulnerability has been fixed in MoinMoin version 1.9.9 and later. It is recommended to upgrade to the latest version to ensure the security of your installation.
Yes, a temporary workaround is to manually validate and sanitize the page names before allowing them to be created. This can help mitigate the risk of exploitation until a proper fix can be applied.
You can find more information about this vulnerability, including the technical details and the fix, in the MoinMoin advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/moin/PYSEC-2016-31.yaml.
Related vulnerabilities
Recent vulnerabilities recorded for moin.
