CVE-2024-41810: Twisted vulnerable to HTML injection in HTTP redirect body

July 29, 2024

The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body.

References

github.com/advisories/GHSA-cf56-g6w6-pqq2
github.com/twisted/twisted
github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33
github.com/twisted/twisted/security/advisories/GHSA-cf56-g6w6-pqq2
nvd.nist.gov/vuln/detail/CVE-2024-41810

Detect and mitigate CVE-2024-41810 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →