CVE-2016-9909

Published: Feb 22, 2017

Modified: Aug 6, 2024

PUBLISHED

Description

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/html5lib/html5lib-python/issues/12

x_refsource_CONFIRM

https://html5lib.readthedocs.io/en/latest/changes.html#b9

x_refsource_CONFIRM

[oss-security] 20161206 CVE Request: html5lib: potential cross-site scripting vulnerablity: quote attributes that need escaping in legacy browsers

mailing-list

x_refsource_MLIST

[oss-security] 20161208 Re: CVE Request: html5lib: potential cross-site scripting vulnerablity: quote attributes that need escaping in legacy browsers

mailing-list

x_refsource_MLIST

95132

vdb-entry

x_refsource_BID

https://github.com/html5lib/html5lib-python/commit/9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7

x_refsource_CONFIRM

https://github.com/html5lib/html5lib-python/issues/11

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2016-9909

Description

Affected Products

References