CVE-2018-20858: XSS Vulnerability in Recommender XBlock
Summary
CVE-2018-20858: Recommender before 2018-07-18 allows XSS. Affects recommender-xblock versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Recommender XBlock is a package available on PyPI that provides recommendation functionality for XBlocks. XBlocks are components used in Open edX, an open-source online learning platform. Recommender XBlock allows instructors to provide personalized recommendations to learners based on their activities and preferences. However, prior to version 1.3.1 released on July 18, 2018, Recommender XBlock was susceptible to a cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The XSS vulnerability in Recommender XBlock allowed an attacker to inject malicious scripts into the application, which could be executed by unsuspecting users. This could lead to various security issues, such as stealing sensitive user information, session hijacking, or performing unauthorized actions on behalf of the user. The vulnerability was identified as CVE-2018-20858 and also tracked as GHSA-3j5x-7ccf-ppgm.
How To Fix
Latest published version: 5.1.0 as of 22 Oct 2026
pip install --upgrade "recommender-xblock==5.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1
This is the first release that contains the fix.
pip install --upgrade "recommender-xblock==1.3.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the Recommender XBlock package prior to version 1.3.1 had a cross-site scripting vulnerability (CVE-2018-20858) that could allow attackers to execute malicious scripts. It is crucial to update to the latest version of the package to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for recommender-xblock →
FAQ
The vulnerability allows an attacker to execute malicious scripts on the application, potentially leading to unauthorized access, data theft, or other security breaches.
No, there is no known workaround for this vulnerability. It is recommended to update to the latest version of the Recommender XBlock package.
No, versions prior to 0.1.3 are not affected by this vulnerability. However, it is still recommended to update to the latest version for overall security improvements.
No, this vulnerability is not specific to any particular operating system. It affects all systems where the vulnerable version of Recommender XBlock is installed.
You can find more information about this vulnerability in the official advisory database of PyPA: https://github.com/pypa/advisory-database/blob/main/vulns/recommender-xblock/PYSEC-2019-219.yaml
