CVE-2017-5934: Cross-site scripting (XSS) vulnerability in MoinMoin
Summary
CVE-2017-5934: Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affects moin across 2 version ranges.
< 1.9.10
< 70955a8eae091cc88fd9a6e510177e70289ec024
Fixed in 70955a8eae091cc88fd9a6e510177e70289ec024. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. The vulnerability in question affects MoinMoin versions prior to 1.9.10. MoinMoin's GUI editor contains a link dialogue that is susceptible to cross-site scripting (XSS) attacks. This vulnerability allows remote attackers to inject arbitrary web script or HTML into the application.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in MoinMoin's link dialogue enables attackers to inject malicious web script or HTML code into the application. This can lead to various security risks, including session hijacking, defacement of web pages, and theft of sensitive user information. The vulnerability is triggered through unspecified vectors, which could involve user input or crafted URLs. Successful exploitation of this vulnerability can compromise the integrity and security of the affected MoinMoin installation.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
70955a8eae091cc88fd9a6e510177e70289ec024
This is the first release that contains the fix.
pip install --upgrade "moin==70955a8eae091cc88fd9a6e510177e70289ec024"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to MoinMoin 1.9.10 is not immediately feasible, users can implement a temporary workaround by disabling the affected link dialogue in the GUI editor. This can be achieved by modifying the relevant code or configuration files. However, it is crucial to note that workarounds may only provide temporary relief and do not address the root cause of the vulnerability. Upgrading to the latest secure version is the recommended long-term solution.
Conclusion
The cross-site scripting (XSS) vulnerability in MoinMoin's link dialogue poses a significant security risk to affected installations. Upgrading to MoinMoin version 1.9.10 or later is strongly recommended to mitigate this vulnerability. Users can also utilize the Vulert playground to check if their MoinMoin installation is affected. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
The vulnerability allows remote attackers to inject malicious web script or HTML into MoinMoin, potentially leading to various security risks such as session hijacking, defacement of web pages, and theft of sensitive user information.
You can use the Vulert playground at Vulert Scanner to check if your MoinMoin installation is affected by this vulnerability. Simply enter your Pipfile.lock and the playground will provide real-time alerts for open-source vulnerabilities.
Yes, a patch is available in MoinMoin version 1.9.10. It is recommended to upgrade to this version or later to fix the vulnerability.
Specific instances of exploitation have not been mentioned in the vulnerability details. However, it is important to address this vulnerability promptly to prevent potential attacks.
You can find more information about this vulnerability in the MoinMoin advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/moin/PYSEC-2018-47.yaml
Related vulnerabilities
Recent vulnerabilities recorded for moin.
