CVE-2022-1592: scout-browser Server-Side Request Forgery Vulnerability
Summary
CVE-2022-1592: Server-Side Request Forgery in scout-browser. Affects scout-browser versions < 4.52. Fixed in 4.52. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The scout-browser package, maintained in the clinical-genomics GitHub repository, is a tool designed for genomic data analysis and visualization. It allows users to interact with genomic data through a web interface. However, prior to version 4.52, the package is susceptible to a server-side request forgery (SSRF) vulnerability, which can be exploited by attackers to perform unauthorized actions.
Vulnerability Detail
The vulnerability arises from improper handling of user input, allowing an attacker to craft requests that the server processes. This could lead to the application making arbitrary requests to internal or external services, potentially exposing sensitive information such as cookies or enabling access to restricted areas. The SSRF vulnerability can also facilitate cross-site scripting (XSS) attacks, further compromising the security of the application.
How To Fix
Latest published version: 4.115.2 as of 23 Oct 2026
pip install --upgrade "scout-browser==4.115.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.52
This is the first release that contains the fix.
pip install --upgrade "scout-browser==4.52"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider implementing input validation and sanitization to restrict the types of requests that can be made by the application. Additionally, you can configure your server to block outgoing requests to untrusted domains.
Conclusion
The scout-browser package has a critical server-side request forgery vulnerability that can be exploited by attackers. It is essential to update to version 4.52 or later to mitigate this risk. Additionally, implementing workarounds such as input validation can help enhance security until an update can be applied.
See every vulnerability recorded for scout-browser →
FAQ
SSRF is a security vulnerability that allows an attacker to send crafted requests from the server to internal or external resources, potentially leading to unauthorized access or data exposure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data, exposure of cookies, and the possibility of cross-site scripting attacks.
Yes, the vulnerability has been patched in version 4.52 of the scout-browser package. Updating to this version will resolve the issue.
The CVSS score for this vulnerability is 8.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for scout-browser.
