HIGH8.2

PYSEC-2026-1126

ansibleguy-webui Cross-site Scripting vulnerability

Quick fix

PYSEC-2026-1126 — ansibleguy-webui: upgrade to the fixed version with the command below.

pip install --upgrade 'ansibleguy-webui>=0.0.21'

Details

### Impact Multiple forms in version <0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser.

### Patches We recommend to upgrade to version >= [0.0.21](https://github.com/ansibleguy/webui/releases/tag/0.0.21)

### References

* [Report](https://github.com/ansibleguy/webui/files/15358522/Report.pdf) * [GitHub Issue 44](https://github.com/ansibleguy/webui/issues/44)

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/ansibleguy-webui

Introduced in: 0Fixed in: 0.0.21

Fixpip install --upgrade 'ansibleguy-webui>=0.0.21'

References

https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2024-36110[ADVISORY]
https://github.com/ansibleguy/webui/issues/44[WEB]
https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522[WEB]
https://github.com/ansibleguy/webui[PACKAGE]
https://github.com/ansibleguy/webui/files/15358522/Report.pdf[WEB]
https://pypi.org/project/ansibleguy-webui[PACKAGE]
https://github.com/advisories/GHSA-927p-xrc2-x2gj[ADVISORY]