CVE-2020-19000: Cross Site Scripting (XSS) in Simiki
Summary
CVE-2020-19000: Cross Site Scripting (XSS) in Simiki. Affects simiki versions < 1.6.2.2. Fixed in 1.6.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Simiki is a Python package available on PyPI that is used for generating static websites. It provides a simple and efficient way to create and manage documentation. Simiki versions 1.6.2.1 and prior are affected by a Cross Site Scripting (XSS) vulnerability.
Vulnerability Detail
The Cross Site Scripting (XSS) vulnerability in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code. The vulnerability originates from line 54 of the component 'simiki/blob/master/simiki/generators.py'. An attacker can exploit this vulnerability to inject malicious code into the generated static website, potentially leading to unauthorized code execution on the client-side.
How To Fix
Minimum fixed version
1.6.2.2
This is the first release that contains the fix.
pip install --upgrade "simiki==1.6.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The Cross Site Scripting (XSS) vulnerability in Simiki v1.6.2.1 and prior can be mitigated by upgrading to version 1.6.2.2 or later. It is important to promptly apply the patch to prevent potential unauthorized code execution on the client-side. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simiki →
FAQ
The vulnerability allows remote attackers to execute arbitrary code on the client-side, potentially leading to unauthorized access or data theft.
No, authentication is not required. The vulnerability can be exploited remotely.
There are no known instances of this vulnerability being exploited in the wild.
Yes, this vulnerability can be exploited without user interaction. An attacker can inject malicious code into the generated static website, which will be executed when accessed by a user.
Implementing a Content Security Policy (CSP) can help mitigate the risk of XSS vulnerabilities by restricting the execution of scripts from unauthorized sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for simiki.
