CVE-2020-15118

In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the wagtail.contrib.forms app, and the page template is built using Django's standard form rendering helpers such as form.asp, any HTML tags used within a form field's help text will be...

coop (>=0.5.0, <=0.5.3), wagtail-flags (2.0.7) +3 more potentially affected by CVE-2020-15118 via wagtail (1.10.1)

wagtail PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =0.5.0, =0.9.0, =0.10.0, =0.10.2 - wagtail-sharing 0.6.0 Source cves: CVE-2020-15118 Source advisory: OSV:GHSA-2473-9HGQ-J7XW...

coderedcms (>=0.18.0, <=0.18.2), coop (>=2.8.0, <=2.8.2) +12 more potentially affected by CVE-2020-15118 via wagtail (>=2.8.0, <=2.8.2)

wagtail PYPI version =2.8.0, =0.18.0, =2.8.0, =0.0.5, =4.1.0, =0.5.0, =1.0.0, =0.22.0, =0.9.8, =3.8.0, =3.9.0 Source cves: CVE-2020-15118 Source advisory: GHSA-2473-9HGQ-J7XW...

coop (>=0.8.0, <=0.8.1), django-wagtail-feeds (0.0.3) +11 more potentially affected by CVE-2020-15118 via wagtail (1.13.4)

wagtail PYPI version 1.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =0.8.0, =0.1.1, =6.0.1, =6.3.0, =0.4.1, =0.4.0, =0.5.1, =0.10.3, =1.0.0, =0.1.0, =0.2.0 Source cves: CVE-2020-15118 Source advisory:...

wapps (>=0.1.1.dev0, <=0.1.2.dev0) potentially affected by CVE-2020-15118 via wagtail (1.13.0)

wagtail PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wapps =0.1.1.dev0, =0.1.2.dev0 Source cves: CVE-2020-15118 Source advisory: OSV:GHSA-2473-9HGQ-J7XW...

wagtailforums (0.1.0a3) potentially affected by CVE-2020-15118 via wagtail (1.0.0)

wagtail PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtailforums 0.1.0a3 Source cves: CVE-2020-15118 Source advisory: OSV:GHSA-2473-9HGQ-J7XW...

coderedcms (>=0.18.0, <=0.18.2), coop (>=2.8.0, <=2.8.2) +12 more potentially affected by CVE-2020-15118 via wagtail (>=2.8.0, <=2.8.2)

wagtail PYPI version =2.8.0, =0.18.0, =2.8.0, =0.0.5, =4.1.0, =0.5.0, =1.0.0, =0.22.0, =0.9.8, =3.8.0, =3.9.0 Source cves: CVE-2020-15118 Source advisory: OSV:GHSA-2473-9HGQ-J7XW...

coop (0.6.0) potentially affected by CVE-2020-15118 via wagtail (1.11.1)

wagtail PYPI version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop 0.6.0 Source cves: CVE-2020-15118 Source advisory: OSV:GHSA-2473-9HGQ-J7XW...

aimmo (>=0.57.1b6141, <=0.61.8b52), cfl-common (>=4.3.0, <=4.14.2) +30 more potentially affected by CVE-2020-15118 via wagtail (>=2.0.2, <=2.6.3)

wagtail PYPI version =2.0.2, =0.57.1b6141, =4.3.0, =2.28.0, =0.5.0, =2.0.0, =0.2.0, =8.0.0, =0.0.1, =8.0.0, =8.0.0, =8.0.0, =1.0.4, =2.4.0, =0.2.0, =1.0.1 and more Source cves: CVE-2020-15118 Source advisory: OSV:GHSA-2473-9HGQ-J7XW...

aimmo (>=0.57.1b6141, <=0.61.8b52), cfl-common (>=4.3.0, <=4.14.2) +44 more potentially affected by CVE-2020-15118 via wagtail (>=1.0.0, <=2.6.3)

wagtail PYPI version =1.0.0, =0.57.1b6141, =4.3.0, =2.28.0, =0.5.0, =0.3.1, =0.2.0, =0.1.1, =5.22.3, =0.0.1, =8.0.0, =8.0.0, =6.3.0, =8.3.3 and more Source cves: CVE-2020-15118 Source advisory: MEND:CVE-2020-15118...

CVE-2020-15118

CVE-2020-15118 affects Wagtail versions before 2.7.4 and 2.9.3, where HTML in form field help_text can be rendered unescaped when using Django form rendering helpers (e.g., form.as_p). This enables potential cross-site scripting via editor-controlled help text. Patches are available: Wagtail 2.7....