CVE-2021-39286: Cross-site scripting in pywb
Summary
CVE-2021-39286: Cross-site scripting in pywb. Affects pywb versions < 2.6.0. Fixed in 2.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pywb is a Python web archiving toolkit that allows users to replay archived web pages. It provides a way to capture, preserve, and replay web pages in an interactive and user-friendly manner. Pywb is vulnerable to a cross-site scripting (XSS) attack due to a lack of autoescaping in Jinja2 templates.
Vulnerability Detail
The vulnerability in pywb allows an attacker to inject malicious scripts into web pages viewed by users. This can lead to various consequences, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user. The lack of autoescaping in Jinja2 templates enables the execution of arbitrary JavaScript code, making it possible for an attacker to exploit this vulnerability.
How To Fix
Latest published version: 2.10.0 as of 22 Oct 2026
pip install --upgrade "pywb==2.10.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.6.0
This is the first release that contains the fix.
pip install --upgrade "pywb==2.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the pywb package is vulnerable to a cross-site scripting (XSS) attack due to a lack of autoescaping in Jinja2 templates. To mitigate this vulnerability, it is crucial to upgrade to pywb version 2.6.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pywb →
FAQ
Pywb is a Python web archiving toolkit that allows users to replay archived web pages.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users.
The potential consequences of this vulnerability include stealing sensitive information, session hijacking, and performing actions on behalf of the user.
To fix this vulnerability, you should upgrade pywb to version 2.6.0 or later.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version.
