CVE-2019-10904: Roundup XSS Vulnerability
Summary
CVE-2019-10904: Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors. Affects roundup versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundup is a package available on PyPI that provides issue tracking and project management capabilities. It is commonly used to manage software development projects. The package allows users to create and track issues, assign tasks, and collaborate with team members. However, a vulnerability has been identified in Roundup version 1.6 that allows for cross-site scripting (XSS) attacks. This vulnerability arises due to mishandling of 404 errors in the frontends/roundup.cgi and roundup/cgi/wsgi_handler.py files.
Vulnerability Detail
The XSS vulnerability in Roundup version 1.6 can be exploited by an attacker to inject malicious code into the application. This can lead to various security risks, including unauthorized access to sensitive information, session hijacking, and the execution of arbitrary code on the victim's browser. The vulnerability originates from the improper handling of 404 errors, which allows an attacker to manipulate the URI and inject malicious scripts or HTML content.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
pip install --upgrade "roundup==2.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.0
This is the first release that contains the fix.
pip install --upgrade "roundup==2.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by modifying the frontends/roundup.cgi and roundup/cgi/wsgi_handler.py files to properly handle 404 errors. This can involve implementing input validation and sanitization techniques to prevent the injection of malicious code. However, it is strongly advised to upgrade to the latest version as soon as possible to fully mitigate the vulnerability.
Conclusion
The Roundup XSS vulnerability (CVE-2019-10904) in version 1.6 poses a significant security risk, allowing for cross-site scripting attacks. To mitigate this vulnerability, it is recommended to upgrade to Roundup version 2.0.0 or later. If immediate upgrading is not possible, implementing temporary workarounds and following best practices for input validation and sanitization can help reduce the risk. It is crucial to address this vulnerability promptly to protect sensitive information and prevent potential attacks. For further support and assistance, contact DevNack.com.
See every vulnerability recorded for roundup →
FAQ
The vulnerability allows for cross-site scripting attacks, which can lead to unauthorized access, data theft, and the execution of malicious code on the victim's browser.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this Roundup XSS vulnerability.
While specific exploits for this vulnerability have not been disclosed, it is important to address the issue promptly to prevent potential attacks.
There have been no specific incidents reported regarding the exploitation of this vulnerability. However, it is crucial to proactively address the issue to minimize the risk of potential attacks.
For further support and assistance in remediating this vulnerability, you can reach out to info@devnack.com. The Devnack team specializes in vulnerability management and can provide guidance on addressing this Roundup XSS vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for roundup.
