—

PYSEC-2021-355

Quick fix

PYSEC-2021-355 — shuup: upgrade to the fixed version with the command below.

pip install --upgrade 'shuup>=0a2db392e8518410c282412561461cd8797eea51'

Details

“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and opens it, the payload gets executed.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/shuup

Introduced in: 0Fixed in: 0a2db392e8518410c282412561461cd8797eea51

Fixpip install --upgrade 'shuup>=0a2db392e8518410c282412561461cd8797eea51'

References

https://github.com/shuup/shuup/commit/0a2db392e8518410c282412561461cd8797eea51[FIX]
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25962[WEB]
https://github.com/advisories/GHSA-663j-rjcr-789f[ADVISORY]