CVE-2019-6802: CRLF Injection in pypiserver
Summary
CVE-2019-6802: CRLF Injection in pypiserver. Affects pypiserver versions < 1.2.6. Fixed in 1.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pypiserver is a package that provides a lightweight PyPI-compatible server for hosting Python packages. It allows users to easily create their own Python package index and serve packages over HTTP. This vulnerability affects pypiserver versions 1.2.5 and below. The vulnerability allows attackers to set arbitrary HTTP headers and potentially conduct XSS attacks by exploiting a CRLF injection in a URI.
Vulnerability Detail
The CRLF injection vulnerability in pypiserver arises from improper handling of user input in certain functions, specifically 'pypiserver._app.simple' and 'pypiserver._app.bad_url'. By injecting a %0d%0a sequence (representing a CRLF character) into a URI, an attacker can manipulate HTTP headers and potentially inject malicious scripts into the server's response. This can lead to cross-site scripting (XSS) attacks, where an attacker can execute arbitrary code in the context of a victim's browser.
How To Fix
Latest published version: 2.4.2 as of 23 Oct 2026
pip install --upgrade "pypiserver==2.4.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.6
This is the first release that contains the fix.
pip install --upgrade "pypiserver==1.2.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by sanitizing user input in the affected functions. This can involve validating and filtering out any CRLF sequences or other potentially malicious characters from the URI before processing it. Here is an example of how to sanitize the input in Python:
import urllib.parse
uri = '... user input URI ...'
# Sanitize the URI
sanitized_uri = urllib.parse.quote(uri, safe='/:')
# Process the sanitized URI
...
Please note that this workaround is not a permanent solution and upgrading to the latest version is strongly recommended.
Conclusion
The CRLF injection vulnerability in pypiserver versions 1.2.5 and below allows attackers to manipulate HTTP headers and potentially conduct XSS attacks. To mitigate this vulnerability, it is recommended to upgrade to pypiserver version 1.2.6 or above. If immediate upgrading is not possible, sanitizing user input in the affected functions can provide a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pypiserver →
FAQ
pypiserver is a lightweight PyPI-compatible server for hosting Python packages. It allows users to create their own Python package index and serve packages over HTTP.
CRLF injection is a web application vulnerability where an attacker can inject CRLF characters (%0d%0a) into input data, potentially manipulating HTTP headers and leading to various attacks such as HTTP response splitting and cross-site scripting (XSS).
This vulnerability in pypiserver allows attackers to set arbitrary HTTP headers and potentially conduct XSS attacks. By injecting malicious scripts into the server's response, an attacker can execute arbitrary code in the context of a victim's browser.
To fix this vulnerability, it is recommended to upgrade to pypiserver version 1.2.6 or above. This version includes a fix for the CRLF injection issue. Alternatively, you can sanitize user input in the affected functions to mitigate the risk temporarily.
Yes, if upgrading to the latest version is not immediately feasible, you can sanitize user input in the affected functions to mitigate the risk temporarily. However, upgrading to the latest version is strongly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypiserver.
