Description
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) certain input processed by formatter/text_gedit.py (aka the gui editor formatter); (2) a page name, which triggers an injection in PageEditor.py when the page is successfully deleted by a victim in a DeletePage action; or (3) the destination page name for a RenamePage action, which triggers an injection in PageEditor.py when a victim's rename attempt fails because of a duplicate name. NOTE: the AttachFile XSS issue is already covered by CVE-2008-0781, and the login XSS issue is already covered by CVE-2008-0780.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | moin | 1.5.3-1.2etch1 | DSA-1514-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | moin | <= 1.5.8 | — | GHSA-8fj9-pj4p-4vq7 |
Advisories 1
- DSA-1514-1 moin Debian Security (DSA / DLA) · Mar 9, 2026
References
- 30031 third-party-advisory
- 33755 third-party-advisory
- GLSA-200803-27 vendor-advisory
- 29262 third-party-advisory
- http://moinmo.in/SecurityFixes
- FEDORA-2008-3328 vendor-advisory
- FEDORA-2008-3301 vendor-advisory
- 29444 third-party-advisory
- http://hg.moinmo.in/moin/1.5/rev/d0152eeb4499
- USN-716-1 vendor-advisory
- moinmoin-multiple-actions-xss(41037) vdb-entry
- 28173 vdb-entry
- DSA-1514 vendor-advisory
- http://hg.moinmo.in/moin/1.5/rev/4ede07e792dd