Description
Cross-site scripting (XSS) vulnerability in the nonjs interface (interfaces/nonjs.pm) in CGI:IRC before 0.5.10 allows remote attackers to inject arbitrary web script or HTML via the R parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | cgiirc | 0.5.9-3squeeze1 | DSA-2158-1 |
| Debian 5.0 | cgiirc | 0.5.9-3lenny3 | DSA-2158-1 |
Advisories 1
- DSA-2158-1 cgiirc - cross-site-scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-2158 vendor-advisory
- ADV-2011-0346 vdb-entry
- [cgiirc-general] 20110207 CGI:IRC 0.5.10 released to fix XSS issue (CVE-2011-0050) mailing-list
- 8097 third-party-advisory
- 20110209 CGI:IRC XSS issue (CVE-2011-0050) mailing-list
- 43217 third-party-advisory
- 70844 vdb-entry