---
id: CVE-2004-1177
aliases:
  - GHSA-rh6c-jh4c-9fg3
  - PYSEC-2026-659
title: 'mailman Cross-site scripting (XSS) vulnerability '
summary: 'mailman Cross-site scripting (XSS) vulnerability '
severity: medium
vendor: mailman
product: mailman
ecosystem: pip
affected:
  - mailman < 2.1.5
patched:
  - mailman 2.1.5
published: '2022-04-29'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-rh6c-jh4c-9fg3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2004-1177'
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18854'
  - url: 'https://github.com/terencehonles/mailman'
  - url: >-
      https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11113
  - url: 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=287555'
  - url: 'http://marc.info/?l=bugtraq&m=110549296126351&w=2'
  - url: 'http://secunia.com/advisories/13603'
  - url: 'http://www.debian.org/security/2005/dsa-674'
  - url: 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:015'
  - url: 'http://www.novell.com/linux/security/advisories/2005_07_mailman.html'
  - url: 'http://www.redhat.com/support/errata/RHSA-2005-235.html'
tags:
  - osv
  - pip
epss: 0.01797
epssPercentile: 0.77143
ingestedAt: '2026-07-08T18:25:52.731Z'
---

## Overview

Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page.

## Affected packages

- `mailman < 2.1.5`

## Remediation

Upgrade to a patched release:

- `mailman 2.1.5`