id: PYSEC-2024-22
modified: 2024-02-01T22:21:01.486817Z
published: 2024-01-23T18:15:00Z
aliases:
- CVE-2024-23341
- GHSA-m4m5-j36m-8x72
details: TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese
  Chinese characters and Roman characters, and extracting sentences of the Taiwanese
  Chinese characters and the Roman characters. Prior to version 1.3.2, when using
  `tuitse_html` without quoting the input, there is a html injection vulnerability.
  Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input
  with HTML quotation.
affected:
- package:
    ecosystem: PyPI
    name: tuitse-tsusin
    purl: pkg:pypi/tuitse-tsusin
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 9d21d99d7cfcd7c42aade251fab98ec102e730ea
    repo: https://github.com/i3thuan5/TuiTse-TsuSin
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.3.2
  versions:
  - 1.0.0
  - 1.1.1
  - 1.2.0
  - 1.2.1
  - 1.3.0
  - 1.3.1
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
references:
- type: ADVISORY
  url: https://github.com/i3thuan5/TuiTse-TsuSin/security/advisories/GHSA-m4m5-j36m-8x72
- type: REPORT
  url: https://github.com/i3thuan5/TuiTse-TsuSin/pull/22
- type: FIX
  url: https://github.com/i3thuan5/TuiTse-TsuSin/pull/22
- type: FIX
  url: https://github.com/i3thuan5/TuiTse-TsuSin/commit/9d21d99d7cfcd7c42aade251fab98ec102e730ea