CVE-2012-6131: Cross-Site Scripting (XSS) in Roundup
Summary
CVE-2012-6131: Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1. Affects roundup versions < 1.4.20. Fixed in 1.4.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundup is a package available on PyPI that provides issue tracking and project management capabilities. It is widely used for managing software development projects. The package allows users to create, track, and update issues, as well as perform various actions related to issue management. However, prior to version 1.4.20, Roundup is vulnerable to a cross-site scripting (XSS) attack in the cgi/client.py module. This vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML code by manipulating the '@action' parameter in the support/issue1 endpoint.
Vulnerability Detail
The vulnerability in Roundup allows attackers to inject malicious web script or HTML code into the application, potentially leading to various security issues. By exploiting this vulnerability, an attacker can execute arbitrary code in the context of the victim's browser, leading to session hijacking, data theft, or other malicious activities. The vulnerability originates from insufficient input sanitization in the '@action' parameter of the support/issue1 endpoint in the cgi/client.py module. This allows an attacker to inject malicious code that is executed when the vulnerable page is rendered.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
pip install --upgrade "roundup==2.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.20
This is the first release that contains the fix.
pip install --upgrade "roundup==1.4.20"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize the input in the '@action' parameter before processing it. This can be done by implementing proper input validation and sanitization techniques, such as HTML entity encoding or using a dedicated library for input sanitization. Here's an example of how to sanitize the '@action' parameter using Python's built-in HTML entity encoding:
import html
action = html.escape(request.params.get('@action'))
Conclusion
The cross-site scripting (XSS) vulnerability in Roundup prior to version 1.4.20 allows remote attackers to inject arbitrary web script or HTML code. This can lead to various security risks, including session hijacking and data theft. To mitigate this vulnerability, it is recommended to upgrade to Roundup version 1.4.20 or later. If immediate upgrade is not possible, implementing proper input validation and sanitization techniques can provide temporary protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for roundup →
FAQ
The vulnerability allows attackers to inject malicious code into the application, potentially leading to session hijacking, data theft, or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
While specific exploits for this vulnerability may exist, they have not been disclosed publicly. However, it is important to patch the vulnerability as soon as possible to prevent potential attacks.
The most effective mitigation is to upgrade to Roundup version 1.4.20 or later. If immediate upgrade is not possible, implementing proper input validation and sanitization techniques can help mitigate the risk.
This vulnerability was discovered and reported by the Roundup development team. They promptly addressed the issue and released a patch in version 1.4.20.
Related vulnerabilities
Recent vulnerabilities recorded for roundup.
