{"id":"CVE-2022-0637","aliases":["GHSA-vg27-hr3v-3cqv","PYSEC-2026-738"],"title":"open redirect in pollbot","summary":"open redirect in pollbot","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","vendor":"pollbot","product":"pollbot","ecosystem":"pip","affected":["pollbot < 1.4.6"],"patched":["pollbot 1.4.6"],"published":"2022-02-16","updated":"2026-07-06","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-vg27-hr3v-3cqv","references":[{"url":"https://github.com/mozilla/PollBot/security/advisories/GHSA-vg27-hr3v-3cqv"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0637"},{"url":"https://github.com/mozilla/PollBot/pull/360"},{"url":"https://github.com/mozilla/PollBot/commit/e39d8bec2df582ba525bb2e2f33c3ebc584d7ff8"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1753838"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2022-0637"},{"url":"https://github.com/mozilla/PollBot"}],"tags":["osv","pip"],"epss":0.00429,"epssPercentile":0.36635,"ingestedAt":"2026-07-08T18:25:53.320Z","slug":"CVE-2022-0637","body":"## Overview\n\n(From https://bugzilla.mozilla.org/show_bug.cgi?id=1753838)\n\nSummary:\nThere was an open redirection vulnerability in the path of:\n\nhttps://pollbot.services.mozilla.com/ and https://pollbot.stage.mozaws.net/\n\nDescription:\nAn attacker can redirect anyone to malicious sites.\n\nSteps To Reproduce:\nType in this URL:\n\nhttps://pollbot.services.mozilla.com/%0a/evil.com/\n\nIt redirects to that website\n\nevil.com\n\nevil.com was used as an example but this could be any website. Note, the /%0a/ and trailing / are required.\n\nSupporting Material/References:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html\n\nImpact\n\nAttackers can serve malicious websites that steal passwords or download ransomware to their victims machine due to a redirect and there are a heap of other attack vectors.\n\n## Affected packages\n\n- `pollbot < 1.4.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pollbot 1.4.6`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}