—

PYSEC-2010-26

Quick fix

PYSEC-2010-26 — python-cjson: upgrade to the fixed version with the command below.

pip install --upgrade 'python-cjson>=1.1.0'

Details

Dan Pascu python-cjson 1.0.5 does not properly handle a ['/'] argument to cjson.encode, which makes it easier for remote attackers to conduct certain cross-site scripting (XSS) attacks involving Firefox and the end tag of a SCRIPT element.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/python-cjson

Introduced in: 0Fixed in: 1.1.0

Fixpip install --upgrade 'python-cjson>=1.1.0'

References

http://t3.dotgnu.info/blog/insecurity/quotes-dont-help.html[ARTICLE]
http://pypi.python.org/pypi/python-cjson/[WEB]
https://github.com/advisories/GHSA-95jp-77w6-qj52[ADVISORY]