{"id":"PYSEC-2022-239","details":"The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.","aliases":["CVE-2022-2514","GHSA-xrf4-39fm-j5f2"],"modified":"2026-07-09T16:56:27.633784097Z","published":"2022-07-25T14:15:00Z","references":[{"type":"WEB","url":"https://huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429"},{"type":"FIX","url":"https://github.com/beancount/fava/commit/ca9e3882c7b5fbf5273ba52340b9fea6a99f3711"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xrf4-39fm-j5f2"}],"affected":[{"package":{"name":"fava","ecosystem":"PyPI","purl":"pkg:pypi/fava"},"ranges":[{"type":"GIT","repo":"https://github.com/beancount/fava","events":[{"introduced":"0"},{"fixed":"ca9e3882c7b5fbf5273ba52340b9fea6a99f3711"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22"}]}],"versions":["0.0.0","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.19","1.20","1.20.1","1.21","1.3","1.4","1.5","1.6","1.7","1.8","1.9"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/fava/PYSEC-2022-239.yaml"}}],"schema_version":"1.7.3"}