CVE-2024-27290 Docassemble HTML and javascript injection
Attackers can inject HTML and JavaScript into user fields, leading to cross-site scripting attacks in Docassemble applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-27290?
CVE-2024-27290 is a medium-severity cross-site scripting vulnerability in jhpyle docassemble, published on 29 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The vulnerability has been patched in version 1.4.97 of the master branch.
Weakness: CWE-79
Which versions are affected by CVE-2024-27290?
3 open source packages ship an affected version, including docassemble-webapp and docassemble.webapp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
docassemble-webapp PyPI | All versions | 1.4.97 |
docassemble-webapp PyPI | All versions | 1.4.97 |
docassemble.webapp PyPI | All versions | 1.4.97 |
Products include Jhpyle Docassemble.
How do I fix CVE-2024-27290?
Upgrade docassemble-webapp to 1.4.97 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-27290 being exploited?
There is no known exploitation of CVE-2024-27290 in the wild and no public exploit code.
Other vulnerabilities in jhpyle docassemble
Sources
Also known as GHSA-pcfx-g2j2-f6f6, PYSEC-2026-1311.