PyPI: inventree
GHSA-85q9-7467-r53q
Safety vulnerability ID: SFTY-20230426-27719
Safety legacy ID: pyup.io-55192
Inventree 0.7.3 and 0.8.0 include a security fix: InvenTree uses EasyMDE for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models). By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser. Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users. - https://huntr.dev/bounties/ab296cf5-7a3e-4f49-8f63-5b35fc707f03
Overview
XSS Vulnerability in Markdown Editor
Advisory
Inventree 0.7.3 and 0.8.0 include a security fix: InvenTree uses EasyMDE for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models). By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser. Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users. - https://huntr.dev/bounties/ab296cf5-7a3e-4f49-8f63-5b35fc707f03
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more