CVE-2021-23824 | BDVDB-2026-167621 Detail

Description#

This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12022-01-13Record published in the CVE List.
2. Version 22024-09-16Most recent update recorded in the CVE List.