CVE-2016-9119: Cross-Site Scripting (XSS) in MoinMoin
Summary
CVE-2016-9119: Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affects moin versions < 1.9.8. Fixed in 1.9.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a GUI editor for creating and editing wiki pages. The vulnerability identified as CVE-2016-9119 is a cross-site scripting (XSS) vulnerability that exists in the link dialogue of the GUI editor in MoinMoin versions prior to 1.9.8. This vulnerability allows remote attackers to inject arbitrary web script or HTML through unspecified vectors.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in MoinMoin's link dialogue can be exploited by remote attackers to inject malicious web script or HTML code. This can lead to various security risks, such as session hijacking, defacement of web pages, and theft of sensitive information. The exact vectors through which the attack can be carried out are not specified in the vulnerability details.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.8
This is the first release that contains the fix.
pip install --upgrade "moin==1.9.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned for this vulnerability.
Conclusion
The cross-site scripting (XSS) vulnerability in MoinMoin's link dialogue can be exploited by remote attackers to inject malicious web script or HTML. It is recommended to upgrade MoinMoin to version 1.9.8 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
The vulnerability allows remote attackers to inject malicious web script or HTML, which can lead to various security risks such as session hijacking, defacement of web pages, and theft of sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your MoinMoin installation is affected by this vulnerability. Simply provide your Pipfile.lock and Vulert will analyze it for vulnerabilities in real-time.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade MoinMoin to version 1.9.8 or later.
The vulnerability details do not mention any specific known exploits.
You can find more information about this vulnerability in the MoinMoin advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/moin/PYSEC-2017-20.yaml
Related vulnerabilities
Recent vulnerabilities recorded for moin.
