Advisoriesby IbisZenMLGHSA-vwgf-7f9h-h499
Cross site scripting in zenml
Fix: upgrade to 0.56.2 or later
A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| zenml PyPI | < 0.56.2 | 0.56.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2024-2171, PYSEC-2024-170
More ZenML advisories
All ZenML
Improper line feed handling in zenmlCVE-2024-4460fixed in 0.57.1zenml-io/zenml does not expire the session after password resetCVE-2024-4680no fix yetImproper authorization in zenmlCVE-2024-2035fixed in 0.56.2Race condition in zenmlCVE-2024-2032fixed in 0.55.5Improper authentication in zenmlCVE-2024-2213fixed in 0.56.3Clickjacking in zenmlCVE-2024-2383fixed in 0.56.3