{"answers":{"affected":"7 open source packages ship an affected version, including wagtail. It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-32681 in the wild and no public exploit code.","fix":"Upgrade wagtail to a fixed version for your release line: 2.11.8, 2.12.5 or 2.13.2.","what":"CVE-2021-32681 is a medium-severity cross-site scripting vulnerability in wagtail, published on 17 Jun 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2021-32681 and fix it if it is affected.\n\nWhat it is: CVE-2021-32681 is a medium-severity cross-site scripting vulnerability in wagtail, published on 17 Jun 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2021-32681 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- wagtail (PyPI): affected all versions; fixed in 2.11.8, 2.12.5, 2.13.2\n- wagtail (PyPI): affected all versions; fixed in 2.11.8\n- wagtail (PyPI): affected all versions; fixed in 2.11.8\n- wagtail (PyPI): affected from 2.12; fixed in 2.12.5\n- wagtail (PyPI): affected from 2.12; fixed in 2.12.5\n- wagtail (PyPI): affected from 2.13; fixed in 2.13.2\n- wagtail (PyPI): affected from 2.13; fixed in 2.13.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-32681/ (Markdown: https://insights.sbomify.com/CVE-2021-32681/index.md)","id":"CVE-2021-32681","markdown":"https://insights.sbomify.com/CVE-2021-32681/index.md","name":"CVE-2021-32681","record":{"aliases":["GHSA-xfrw-hxr5-ghqf","PYSEC-2021-103"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["code_execution","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"Wagtail CMS","requires_auth":"low_privilege","summary":"Editors can inject arbitrary HTML or scripts via StreamField blocks due to improper escaping, potentially leading to code execution or account takeover.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"wagtail","vendor":"torchbox"}],"cvss":{"score":5.4,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the `{% include_block %}` template tag is used to output the value of a plain-text StreamField block (`CharBlock`, `TextBlock` or a similar user-defined block derived from `FieldBlock`), and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This could allow users to insert arbitrary HTML or scripting. This vulnerability is only exploitable by users with the ability to author StreamField content (i.e. users with 'editor' access to the Wagtail admin). Patched versions have been released as Wagtail 2.11.8 (for the LTS 2.11 branch), Wagtail 2.12.5, and Wagtail 2.13.2 (for the current 2.13 branch). As a workaround, site implementors who are unable to upgrade to a current supported version should audit their use of `{% include_block %}` to ensure it is not used to output `CharBlock` / `TextBlock` values with no associated template. Note that this only applies where `{% include_block %}` is used directly on that block (uses of `include_block` on a block _containing_ a CharBlock / TextBlock, such as a StructBlock, are unaffected). In these cases, the tag can be replaced with Django's `{{ ... }}` syntax - e.g. `{% include_block my_title_block %}` becomes `{{ my_title_block }}`.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks","id":"CVE-2021-32681","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"xss","year":"2021"},"n_packages":7,"n_references":4,"next":{"headline":"Multiple vulnerabilities leading to RCE","id":"CVE-2021-32682"},"packages":[{"ecosystem":"PyPI","fixed":["2.11.8","2.12.5","2.13.2"],"introduced":["0","2.12","2.13"],"last_affected":[],"package":"wagtail","purl":"pkg:pypi/wagtail","source":"PYSEC-2021-103"},{"ecosystem":"PyPI","fixed":["2.11.8"],"introduced":["0"],"last_affected":[],"package":"wagtail","purl":null,"source":"GHSA-xfrw-hxr5-ghqf"},{"ecosystem":"PyPI","fixed":["2.11.8"],"introduced":["0"],"last_affected":[],"package":"wagtail","purl":"pkg:pypi/wagtail","source":"GHSA-xfrw-hxr5-ghqf"},{"ecosystem":"PyPI","fixed":["2.12.5"],"introduced":["2.12"],"last_affected":[],"package":"wagtail","purl":null,"source":"GHSA-xfrw-hxr5-ghqf"},{"ecosystem":"PyPI","fixed":["2.12.5"],"introduced":["2.12"],"last_affected":[],"package":"wagtail","purl":"pkg:pypi/wagtail","source":"GHSA-xfrw-hxr5-ghqf"},{"ecosystem":"PyPI","fixed":["2.13.2"],"introduced":["2.13"],"last_affected":[],"package":"wagtail","purl":null,"source":"GHSA-xfrw-hxr5-ghqf"},{"ecosystem":"PyPI","fixed":["2.13.2"],"introduced":["2.13"],"last_affected":[],"package":"wagtail","purl":"pkg:pypi/wagtail","source":"GHSA-xfrw-hxr5-ghqf"}],"prev":{"headline":"Audit log is not properly logging unsetting of share expiration date","id":"CVE-2021-32680"},"products":["wagtail"],"published":"2021-06-17","related":[{"cvss_score":7.3,"headline":"Wagtail: Reflected XSS in dynamic image URL generator view","id":"CVE-2026-54263","kev_date_added":null,"published":"2026-07-01"},{"cvss_score":6.5,"headline":"Wagtail: Improper permission handling in image preview","id":"CVE-2026-54261","kev_date_added":null,"published":"2026-07-01"},{"cvss_score":6.5,"headline":"Wagtail: Improper permission handling when comparing revisions","id":"CVE-2026-44197","kev_date_added":null,"published":"2026-05-11"},{"cvss_score":6.5,"headline":"Wagtail: Improper permission handling when deleting form submissions","id":"CVE-2026-44199","kev_date_added":null,"published":"2026-05-11"},{"cvss_score":6.5,"headline":"Wagtail: Improper permission handling when copying pages","id":"CVE-2026-44200","kev_date_added":null,"published":"2026-05-11"},{"cvss_score":6.5,"headline":"Wagtail regular expression denial-of-service via search query parsing","id":"CVE-2024-39317","kev_date_added":null,"published":"2024-07-11"},{"cvss_score":6.4,"headline":"Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views","id":"CVE-2023-28836","kev_date_added":null,"published":"2023-04-03"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-03","vendors":["wagtail"]},"summary":"Editors can inject arbitrary HTML or scripts via StreamField blocks due to improper escaping, potentially leading to code execution or account takeover.","url":"https://insights.sbomify.com/CVE-2021-32681/"}