{"id":"CVE-2021-41132","aliases":["GHSA-g67g-hvc3-xmvf","PYSEC-2021-372","PYSEC-2021-379"],"title":"Inconsistent input sanitisation leads to XSS vectors","summary":"Inconsistent input sanitisation leads to XSS vectors","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"omero-web","product":"omero-web","ecosystem":"pip","affected":["omero-web < 5.11.0","omero-figure < 4.4.1"],"patched":["omero-web 5.11.0","omero-figure 4.4.1"],"published":"2021-10-14","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-g67g-hvc3-xmvf","references":[{"url":"https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41132"},{"url":"https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424"},{"url":"https://github.com/ome/omero-web"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/omero-figure/PYSEC-2021-379.yaml"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/omero-web/PYSEC-2021-372.yaml"},{"url":"https://www.openmicroscopy.org/security/advisories/2021-SV3"}],"tags":["osv","pip"],"epss":0.01039,"epssPercentile":0.62425,"ingestedAt":"2026-07-08T18:25:49.637Z","slug":"CVE-2021-41132","body":"## Overview\n\n### Background\n\nA variety of templates do not perform proper sanitization through HTML escaping.\nDue to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of XSS possibilities with specially crafted input to a variety of fields.\n\n### Impact\n\nOMERO.web before 5.11.0 and OMERO.figure before 4.4.1.\n\n### Patches\nUsers should upgrade OMERO.web to 5.11.0 or higher and OMERO.figure to 4.4.1 or higher.\n\n## Affected packages\n\n- `omero-web < 5.11.0`\n- `omero-figure < 4.4.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `omero-web 5.11.0`\n- `omero-figure 4.4.1`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}