{"id":"PYSEC-2019-150","details":"Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.","aliases":["CVE-2017-1002152","GHSA-h896-6hcp-gj6c"],"modified":"2026-06-10T17:00:37.280311941Z","published":"2019-01-10T21:29:00Z","references":[{"type":"REPORT","url":"https://github.com/fedora-infra/bodhi/issues/1740"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-h896-6hcp-gj6c"}],"affected":[{"package":{"name":"bodhi","ecosystem":"PyPI","purl":"pkg:pypi/bodhi"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0"}]}],"versions":["2.3.0","2.3.1","2.3.3","2.4.0","2.5.0","2.7.0","2.9.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/bodhi/PYSEC-2019-150.yaml"}}],"schema_version":"1.7.5"}