PT-2024-21798 · Unknown · Docassemble

Richighimi + 1 · Published 2024-02-29 · Updated 2025-09-02 · CVE-2024-27290

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Docassemble versions prior to 1.4.97

Description The issue allows a user to type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The HTML can also contain <script> tags, allowing JavaScript to execute on the page.

Recommendations For versions prior to 1.4.97, update to version 1.4.97 of the master branch to resolve the issue. If upgrading is not possible, manually apply the changes of the specified commit and restart the server.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-27290

GHSA-PCFX-G2J2-F6F6

Affected Products

Docassemble

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27290.json · Exploit
• https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac09523077930cdb6dea2aa · Patch
• https://osv.dev/vulnerability/GHSA-pcfx-g2j2-f6f6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27290 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27290 · Security Note
• https://github.com/jhpyle/docassemble · Note
• https://github.com/jhpyle/docassemble/security/advisories/GHSA-pcfx-g2j2-f6f6 · Note
• https://t.me/cveNotify/134070 · Telegram Post
• https://twitter.com/CVEnew/status/1763321341594185828 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1770723995513495660 · Twitter Post