{"id":"GHSA-94ww-22rx-493x","summary":"Cross-Site Scripting","details":"Flower, before 0.9.2, has a XSS on tasks page because data is not properly escaped.","modified":"2024-12-01T05:32:18.372691Z","published":"2021-02-24T19:46:35Z","withdrawn":"2021-02-24T19:46:35Z","database_specific":{"cwe_ids":[],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2019-06-05T13:52:45Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/mher/flower/issues/650"},{"type":"WEB","url":"https://github.com/mher/flower/commit/0f2eab324f65823340a0146f7a2b44804e4725ee"}],"affected":[{"package":{"name":"flower","ecosystem":"PyPI","purl":"pkg:pypi/flower"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.3.1","0.4.0","0.4.2","0.4.3","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/02/GHSA-94ww-22rx-493x/GHSA-94ww-22rx-493x.json"}}],"schema_version":"1.9.0"}