PYSEC-2026-643
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/horizon/PYSEC-2026-643.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-643
- Aliases
- Published
- 2026-07-02T14:13:22.820828Z
- Modified
- 2026-07-06T08:00:37.654180143Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
- Details
-
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2016-4428
- https://github.com/openstack/horizon/commit/62b4e6f30a7ae7961805abdffdb3c7ae5c2b676a
- https://github.com/openstack/horizon/commit/d585e5eb9acf92d10d39b6c2038917a7e8ac71bb
- https://github.com/openstack/horizon/commit/fc8d70560401f3985e5672a4c580f10d51e985a4
- https://access.redhat.com/errata/RHSA-2016:1268
- https://access.redhat.com/errata/RHSA-2016:1269
- https://access.redhat.com/errata/RHSA-2016:1270
- https://access.redhat.com/errata/RHSA-2016:1271
- https://access.redhat.com/errata/RHSA-2016:1272
- https://access.redhat.com/security/cve/CVE-2016-4428
- https://bugs.launchpad.net/horizon/+bug/1567673
- https://bugzilla.redhat.com/show_bug.cgi?id=1343982
- https://review.openstack.org/329996
- https://review.openstack.org/329997
- https://review.openstack.org/329998
- https://security.openstack.org/ossa/OSSA-2016-010.html
- http://www.debian.org/security/2016/dsa-3617
- http://www.openwall.com/lists/oss-security/2016/06/17/4
- https://pypi.org/project/horizon
- https://github.com/advisories/GHSA-grm6-x6mr-q3cv
Affected packages
PyPI / horizon
Package
- Name
- horizon
- View open source insights on deps.dev
- Purl
- pkg:pypi/horizon