CVE-2012-6133: Cross-Site Scripting (XSS) in Roundup
Summary
CVE-2012-6133: Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*. Affects roundup versions < 1.4.20. Fixed in 1.4.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundup is a Python-based issue tracking system that allows users to create and manage issues, track progress, and collaborate on projects. It is commonly used for bug tracking, project management, and customer support. Roundup versions prior to 1.4.20 are affected by multiple cross-site scripting (XSS) vulnerabilities.
Vulnerability Detail
The identified vulnerabilities in Roundup versions before 1.4.20 are classified as cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML into the application. The vulnerabilities are triggered by the '@ok_message' and '@error_message' parameters in the 'issue*' endpoint. Exploiting these vulnerabilities can lead to various consequences, including unauthorized access, data theft, and potential compromise of user accounts.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
pip install --upgrade "roundup==2.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.20
This is the first release that contains the fix.
pip install --upgrade "roundup==1.4.20"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can sanitize the input provided to the '@ok_message' and '@error_message' parameters to prevent the execution of malicious scripts. This can be achieved by implementing proper input validation and output encoding techniques. Here is an example of how to sanitize the input in Python:
import html
ok_message = html.escape(user_input)
error_message = html.escape(user_input)
Note: This workaround is not a permanent solution and should be replaced with the recommended upgrade as soon as possible.
Conclusion
In conclusion, Roundup versions before 1.4.20 are affected by multiple XSS vulnerabilities. It is crucial to upgrade to the latest version to ensure the security and integrity of your Roundup installation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for roundup →
FAQ
Roundup is a Python-based issue tracking system used for bug tracking, project management, and customer support.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Exploiting these vulnerabilities can lead to unauthorized access, data theft, and compromise of user accounts.
To fix the vulnerability, upgrade Roundup to version 1.4.20 or later.
Yes, you can sanitize the input provided to the '@ok_message' and '@error_message' parameters to prevent the execution of malicious scripts.
Related vulnerabilities
Recent vulnerabilities recorded for roundup.
