Search: CVE-2024-41810

The Twisted web framework's redirectTo function contains an HTML injection vulnerability that can lead to reflected cross-site scripting (XSS) if an attacker controls the redirect URL. This occurs because the redirectTo function reflects the destination URL in the HTML body without encoding, allowing injection of arbitrary HTML/JavaScript. The vulnerability is exploitable only in Firefox due to its handling of the redirect response body. Exploitation could allow malicious scripts to run in the victim's session context, potentially leading to unauthorized access or actions. Affected versions are Twisted versions used by Scrapy from 2.9.0 up to but not including 2.11.2_3. A patch is available for this issue.