CVE-2026-79311

python-webpy: webpy: Missing autoescape in render_jinja leads to Cross-Site Scripting (XSS)

View on CVE.org
Published Sep 22, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Description
webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Cross‑Site Scripting in Web.py 0.76 render_jinja Initialization python-webpy: webpy: Missing autoescape in render_jinja leads to Cross-Site Scripting (XSS)
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

threat_severity

Moderate
Type Values Removed Values Added
First Time appeared Webpy
Webpy webpy
Vendors & Products Webpy
Webpy webpy
Type Values Removed Values Added
Title Cross‑Site Scripting in Web.py 0.76 render_jinja Initialization
Weaknesses CWE-79
Type Values Removed Values Added
Description webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Oct 6, 2026, 5:43 PM
Reserved
Aug 25, 2026, 12:00 AM

View source JSON

Updated
Oct 6, 2026, 3:33 PM

JSON

Status
Deferred
Published
Sep 22, 2026, 4:17 PM
Modified
Oct 6, 2026, 6:16 PM

View source JSON

Severity
Moderate
Public date
Sep 22, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Sep 26, 2026, 6:15 AM

JSON