PYSEC-2026-1230
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/calibreweb/PYSEC-2026-1230.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1230
- Aliases
- Published
- 2026-07-07T14:34:37.138202Z
- Modified
- 2026-07-07T17:47:33.623366523Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Calibre-Web Cross Site Scripting (XSS)
- Details
-
In janeczku Calibre-Web 0.6.0 to 0.6.21, the editbookcomments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the cleanstring function. The vulnerability arises from the way the cleanstring function handles HTML sanitization.
- References
Affected packages
PyPI / calibreweb
Package
- Name
- calibreweb
- View open source insights on deps.dev
- Purl
- pkg:pypi/calibreweb