CVE-2019-10904: XSS Vulnerability in Roundup
Summary
CVE-2019-10904: Moderate severity vulnerability that affects roundup. Affects roundup versions < 2.0.0alpha0. Fixed in 2.0.0alpha0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundup is a package available on PyPI that provides issue tracking and project management capabilities. It is commonly used to manage bug reports, feature requests, and other tasks in software development projects. The package allows users to create, view, and modify issues through a web interface. However, a vulnerability has been discovered in Roundup version 1.6 that enables cross-site scripting (XSS) attacks. This vulnerability arises due to mishandling of 404 errors in the frontends/roundup.cgi and roundup/cgi/wsgi_handler.py files.
Vulnerability Detail
The XSS vulnerability in Roundup version 1.6 allows an attacker to inject malicious code into the URI, which is then executed by the victim's browser. This can lead to various security risks, including the theft of sensitive information, session hijacking, and unauthorized actions on behalf of the victim. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-79, which refers to improper neutralization of input during web page generation.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
pip install --upgrade "roundup==2.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.0alpha0
This is the first release that contains the fix.
pip install --upgrade "roundup==2.0.0alpha0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a non-affected version of Roundup is not immediately feasible, users can implement a workaround to mitigate the risk of exploitation. One possible workaround is to modify the affected files (frontends/roundup.cgi and roundup/cgi/wsgi_handler.py) to properly handle 404 errors and sanitize user input to prevent XSS attacks. Here is an example of how the code can be modified in the roundup.cgi file:
# Original code
if not item:
raise NotFoundError, 'No such item %s' % itemid
# Modified code
if not item:
# Handle 404 error appropriately
return '404 Not Found'
Conclusion
In conclusion, Roundup version 1.6 is vulnerable to an XSS attack due to mishandling of 404 errors. Upgrading to a non-affected version of Roundup or implementing the suggested workaround will mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for roundup →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the victim's browser, potentially leading to the theft of sensitive information, session hijacking, and unauthorized actions.
The vulnerability affects Roundup versions 0 to 1.6 (inclusive). Any version after 1.6 is not affected.
Yes, upgrading to a version of Roundup that is not affected by this issue (version > 1.6) will fix the vulnerability.
Yes, users can modify the affected files to handle 404 errors properly and sanitize user input to prevent XSS attacks.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for roundup.
