{"id":"CVE-2021-39286","details":"Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.","aliases":["GHSA-947x-pv47-pp3q","PYSEC-2021-120"],"modified":"2026-07-08T23:59:01.569768Z","published":"2021-08-18T18:15:08.177Z","references":[{"type":"ADVISORY","url":"https://github.com/webrecorder/pywb/compare/v-2.5.0...v-2.6.0"},{"type":"FIX","url":"https://github.com/webrecorder/pywb/commit/f7bd84cdacdd665ff73ae8d09a202f60be2ebae9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/webrecorder/pywb","events":[{"introduced":"0"},{"fixed":"96de80f83e2e18a333f488d54d21d98dce3b9433"},{"fixed":"f7bd84cdacdd665ff73ae8d09a202f60be2ebae9"}],"database_specific":{"cpe":"cpe:2.3:a:webrecorder:pywb:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.6.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v-2.6.0b1","v-2.6.0b0","v-2.5.0","v-2.4.2","v-2.4.1","v-2.4.0","v-2.4.0-rc7","v-2.4.0-rc5","v-2.4.0rc4","v-2.4.0-rc2","v-2.4.0-rc1","v-2.4.0-rc0","v-2.3.1","v-2.3.0","v-2.2.20190410","v-2.2.20190311","v-2.2.20190227","0.32.0","0.11.0","0.10.10","0.10.9.1","0.10.9","0.10.8","0.10.5","0.10.1","0.9.5","0.9.0","0.8.0","0.7.1","0.7.0","0.6.2","0.6.0","0.4.0","0.3.0","0.2.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39286.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}