Threats tagged 'ghsa-vp6q-7m36-pq3w'

Bugsink versions prior to 2.0.13 are vulnerable to a stored Cross-Site Scripting (XSS) flaw via the Pygments fallback mechanism in stacktrace rendering. An unauthenticated attacker who can submit events to a Bugsink project can inject arbitrary JavaScript payloads into event data. The malicious script executes only when an administrator views the affected stacktrace in the Bugsink web UI. The vulnerability arises because when Pygments returns more lines than requested, Bugsink falls back to rendering raw input lines without proper sanitization, applying mark_safe unconditionally. This allows stored XSS payloads to persist in the database and execute in the context of an admin user.