Cross Site Scripting (XSS) in web.py

Executive Summary

CVE-2026-79311 is a Cross-Site Scripting (XSS) vulnerability in the web.py Python web framework version 0.76. It affects the Jinja2 template adapter which does not enable automatic HTML escaping by default. This allows unescaped user-controlled input to be rendered in HTML pages, potentially leading to malicious script execution in a victim's browser.

Useful 0 Not Useful 0

Detection Guidance

To detect this XSS vulnerability in web.py 0.76, check if your application uses the Jinja2 adapter for HTML templates and if automatic HTML escaping is disabled. Inspect template files for unescaped user-controlled variables. No specific commands are provided in the resources, but review application code for render_jinja.__init__() usage without HTML escaping.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you if you use web.py 0.76 with the Jinja2 adapter for HTML templates and pass user-controlled data as template variables. Attackers could exploit it to execute scripts in your users' browsers, enabling data theft, session hijacking, or unauthorized actions on their behalf.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could lead to breaches of GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access to sensitive user data. Organizations using affected web.py versions may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Enable automatic HTML escaping in the Jinja2 adapter or application configuration. Update web.py if a patched version is released. Validate all template variables to ensure user input is properly escaped. Test the fix by verifying malicious scripts are not executed in rendered pages.

Useful 0 Not Useful 0