CVE-2024-23341Medium· 6.1▾ Sunlithtml injection vulnerability in the `tuitse_html` function.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
When using tuitse_html without quoting the input, there is a html injection vulnerability. It should use the django version django.utils.html.format_html, instead of string.format()
Upgrade to version 1.3.2.
Sanitizing Taigi input with HTML quotation.
https://github.com/i3thuan5/TuiTse-TsuSin/pull/22
tuitse-tsusin < 1.3.2Upgrade to a patched release:
tuitse-tsusin 1.3.2