CVE-2016-10516 Pallets Werkzeug cross-site scripting vulnerability

What is CVE-2016-10516?

CVE-2016-10516 is a medium-severity cross-site scripting vulnerability in n/a, published on 23 Oct 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.

Weakness: CWE-79

Which versions are affected by CVE-2016-10516?

3 open source packages ship an affected version, including werkzeug and Werkzeug. It affects 1 product.

Products include Palletsprojects Werkzeug.

How do I fix CVE-2016-10516?

Upgrade werkzeug to 0.11.11 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2016-10516 being exploited?

There is no known exploitation of CVE-2016-10516 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-29361 Other in n/a Critical 9.8
• CVE-2023-46136 Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning High 8.0
• CVE-2023-25577 Werkzeug may allow high resource usage when parsing multipart form data with many fields High 7.5
• CVE-2019-14322 Pallets Werkzeug vulnerable to Path Traversal High 7.5
• CVE-2026-27199 Werkzeug safe_join() allows Windows special device names Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2016-10516, DLA-1191-1, GHSA-h2fp-xgx6-xh6f, PYSEC-2017-43, UBUNTU-CVE-2016-10516, USN-3463-1.