Threats affecting pkg:pypi/otterwiki

Otter Wiki versions from 2.20.1 up to but not including 2.26.2 have a file disclosure vulnerability in the DataTable embedding feature. This flaw allows attackers who can edit pages, including anonymous users under default settings, to read internal repository files by specifying absolute paths such as /.git/config. The vulnerability was fixed in version 2.26.2.

An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page.