Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
Patchwork v1 lets malicious message IDs execute code
published 4 days ago
Summary
In Patchwork version 1, the part of the system that shows message IDs does not filter out dangerous content. An attacker could embed a script in a message ID and cause a user's browser to run that script, potentially exposing data or taking actions as the user. Apply the vendor's update or patch that adds proper input sanitization, and review any custom templates for similar risks.
What to do
- Update cleanstart patchwork to version 2.0.1-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | patchwork |
< 2.0.1-r1 Fix: upgrade to 2.0.1-r1
|
Original advisory text
Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1
Security vulnerability affects the patchwork package. A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2023-RM49348 · OSV
Track software like this
Free during beta