Description
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | roundup | 1.4.15-3+deb6u1 | DLA-298-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | roundup | < 1.4.20 | 1.4.20 | GHSA-5v6q-xqq8-g4xj |
Advisories 1
- DLA-298-1 roundup - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=722672
- [oss-security] 20130213 Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version mailing-list
- [oss-security] 20121110 CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version mailing-list
- roundup-cve20126132-otk-xss(84191) vdb-entry