CVE-2012-6133: Cross-Site Scripting (XSS) Vulnerabilities in Roundup
Summary
CVE-2012-6133: Multiple cross-site scripting (XSS) vulnerabilities in Roundup. Affects roundup versions < 1.4.20. Fixed in 1.4.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundup is an open-source issue tracking system written in Python. It provides a web-based interface for managing and tracking issues, allowing users to submit, view, and update issues. The vulnerability in question affects versions of Roundup prior to 1.4.20.
Vulnerability Detail
Multiple cross-site scripting (XSS) vulnerabilities have been discovered in Roundup. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML into the application. The vulnerabilities are present in the '@ok_message' and '@error_message' parameters of the 'issue*' endpoint. An attacker can exploit these vulnerabilities by crafting malicious input that is not properly sanitized by the application, leading to the execution of arbitrary code or the manipulation of the application's content.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
pip install --upgrade "roundup==2.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.20
This is the first release that contains the fix.
pip install --upgrade "roundup==1.4.20"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize and validate user input before using it in the '@ok_message' and '@error_message' parameters. This can be done by implementing proper input validation and output encoding techniques to prevent the execution of malicious scripts.
Conclusion
In conclusion, multiple cross-site scripting (XSS) vulnerabilities have been identified in Roundup before version 1.4.20. These vulnerabilities can be exploited by remote attackers to inject arbitrary web script or HTML into the application. It is recommended to upgrade to Roundup 1.4.20 or later to mitigate these vulnerabilities. Alternatively, implementing proper input validation and output encoding techniques can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for roundup →
FAQ
The vulnerabilities allow attackers to inject malicious scripts or HTML into the application, potentially leading to unauthorized access, data theft, or the manipulation of the application's content.
At the time of this advisory, there are no known public exploits specifically targeting these vulnerabilities. However, it is important to promptly apply the recommended patches or workarounds to mitigate the risk.
Yes, these vulnerabilities can be exploited remotely by sending specially crafted requests to the vulnerable application.
No, authentication is not required to exploit these vulnerabilities. Any remote attacker can potentially exploit these vulnerabilities.
Yes, the vulnerabilities have been reported to the Roundup project, and they have released a fixed version (1.4.20) addressing these issues.
Related vulnerabilities
Recent vulnerabilities recorded for roundup.
