CVE-2005-4644: Cross-Site Scripting (XSS) in Trac
Summary
CVE-2005-4644: Cross-site scripting (XSS) vulnerability in the HTML WikiProcessor in Edgewall Trac 0.9.2 allows remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag. Affects trac versions < 0.10. Fixed in 0.10. How to fix ↓
Also tracked for
- trac · Debian:13
The same CVE-2005-4644 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Trac is an open-source project management and issue tracking system written in Python. It provides a web-based interface for managing software development projects. Trac version 0.9.2 is affected by a cross-site scripting (XSS) vulnerability in the HTML WikiProcessor. This vulnerability allows remote attackers to inject arbitrary web script or HTML by exploiting the SRC attribute of an IMG tag.
Vulnerability Detail
The XSS vulnerability in Trac 0.9.2 arises from insufficient input sanitization in the HTML WikiProcessor. Attackers can exploit this vulnerability by injecting malicious JavaScript code into the SRC attribute of an IMG tag. When a user views a page containing the manipulated IMG tag, the injected script executes in the user's browser, potentially leading to unauthorized actions, data theft, or other malicious activities.
How To Fix
Latest published version: 1.6.0 as of 22 Oct 2026
pip install --upgrade "trac==1.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10
This is the first release that contains the fix.
pip install --upgrade "trac==0.10"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Trac is not immediately feasible, a temporary workaround can be implemented by manually sanitizing user input before it is processed by the HTML WikiProcessor. This can be achieved by implementing proper input validation and sanitization routines in the application code. For example, input filtering functions or HTML encoding can be used to neutralize any potential XSS payloads.
Conclusion
The XSS vulnerability in Trac 0.9.2 poses a significant security risk as it allows remote attackers to inject malicious scripts or HTML code. Upgrading to a secure version, such as Trac 0.10 or later, is the recommended solution. In the meantime, implementing proper input validation and sanitization routines can serve as a temporary workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for trac →
FAQ
The vulnerability allows attackers to inject malicious scripts or HTML code into Trac pages, potentially leading to unauthorized actions, data theft, or other malicious activities.
Trac version 0.9.2 is affected by this vulnerability. Users of this specific version should take immediate action to mitigate the risk.
While specific exploits for this vulnerability may exist, they have not been disclosed in the provided information. However, it is crucial to address this vulnerability promptly to prevent potential exploitation.
No specific incidents related to this vulnerability have been mentioned in the provided information. However, it is important to stay vigilant and apply the recommended fixes to prevent any potential incidents.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Trac installation is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities, including this specific issue.
Related vulnerabilities
Recent vulnerabilities recorded for trac.
