{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-79311", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-09-22T15:23:15.855Z", "dateReserved": "2026-08-25T00:00:00.000Z", "datePublished": "2026-09-22T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-22T15:23:15.855Z"}, "descriptions": [{"lang": "en", "value": "webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__()."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/webpy/webpy"}, {"url": "https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79311.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}}, "dataVersion": "5.2"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__()."}], "id": "CVE-2026-79311", "lastModified": "2026-09-22T20:00:03.713", "metrics": {}, "published": "2026-09-22T16:17:56.513", "references": [{"source": "[email protected]", "url": "https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79311.md"}, {"source": "[email protected]", "url": "https://github.com/webpy/webpy"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "python-webpy: webpy: Missing autoescape in render_jinja leads to Cross-Site Scripting (XSS)", "id": "2538138", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538138"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().", "A flaw was found in webpy. The `render_jinja` template adapter does not enable automatic HTML escaping when initializing the Jinja2 environment. Applications using this adapter that render user-controlled data in templates are vulnerable to cross-site scripting (XSS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-79311", "public_date": "2026-09-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-79311\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-79311\nhttps://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79311.md\nhttps://github.com/webpy/webpy"], "statement": "Red Hat does not ship webpy in any supported product. The python-webpy package is available in EPEL, which is maintained by the Fedora community.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0.76"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "webpy", "vendor": "webpy"}], "created": "2026-09-22T17:00:12.816681+00:00", "updated": "2026-09-26T06:15:06.112191+00:00", "vendors": ["webpy", "webpy$PRODUCT$webpy"]}