---
id: CVE-2017-1000426
aliases:
  - GHSA-g4rw-82hq-8jpr
  - PYSEC-2026-841
title: MapProxy vulnerable to cross-site scripting in demo service
summary: MapProxy vulnerable to cross-site scripting in demo service
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: mapproxy
product: mapproxy
ecosystem: pip
affected:
  - mapproxy < 1.11.1
patched:
  - mapproxy 1.11.1
published: '2022-05-13'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-g4rw-82hq-8jpr'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2017-1000426'
  - url: 'https://github.com/mapproxy/mapproxy/issues/322'
  - url: >-
      https://github.com/mapproxy/mapproxy/commit/420412aad45171e05752007a0a2350c03c28dfd8
  - url: >-
      https://github.com/mapproxy/mapproxy/commit/436c8f489761d1b4ee22b2440b53cc96bbc28aea
  - url: 'https://github.com/mapproxy/mapproxy'
tags:
  - osv
  - pip
epss: 0.00783
epssPercentile: 0.54555
ingestedAt: '2026-07-08T18:25:49.227Z'
---

## Overview

MapProxy version 1.11.1 and older are vulnerable to cross-site scripting in the demo service resulting in possible information disclosure. An incomplete fix was released in v[1.10.4](https://github.com/mapproxy/mapproxy/issues/322#issuecomment-518573169), and a complete fix was released in v[1.11.1](https://github.com/mapproxy/mapproxy/commit/436c8f489761d1b4ee22b2440b53cc96bbc28aea).

## Affected packages

- `mapproxy < 1.11.1`

## Remediation

Upgrade to a patched release:

- `mapproxy 1.11.1`