id: PYSEC-2022-226
details: The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting
  (XSS) via the query string parameter q. In the case where it does not contain the
  http string, it is used to build the error_message that is then rendered in the
  error.html template, using the [flask.render_template](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template)
  function. However, the error_message is rendered using the [| safe filter](https://jinja.palletsprojects.com/en/3.1.x/templates/working-with-automatic-escaping),
  meaning the user input is not escaped.
aliases:
- CVE-2022-25303
- SNYK-PYTHON-WHOOGLESEARCH-2803306
- GHSA-mxvc-fwgx-j778
modified: '2022-07-14T05:11:54.875994Z'
published: '2022-07-12T15:15:00Z'
references:
- type: WEB
  url: https://github.com/benbusby/whoogle-search/blob/6d362ca5c7a00d2f691a2512461c5dfbfc01cbb3/app/routes.py%23L448
- type: ADVISORY
  url: https://snyk.io/vuln/SNYK-PYTHON-WHOOGLESEARCH-2803306
- type: FIX
  url: https://github.com/benbusby/whoogle-search/commit/abc30d7da3b5c67be7ce84d4699f327442d44606
- type: ADVISORY
  url: https://github.com/advisories/GHSA-mxvc-fwgx-j778
affected:
- package:
    name: whoogle-search
    ecosystem: PyPI
    purl: pkg:pypi/whoogle-search
  ranges:
  - type: GIT
    repo: https://github.com/benbusby/whoogle-search
    events:
    - introduced: '0'
    - fixed: abc30d7da3b5c67be7ce84d4699f327442d44606
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 0.7.2
  versions:
  - 0.1.0
  - 0.1.3
  - 0.1.4
  - 0.2.0
  - 0.2.1
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.4.0
  - 0.4.1
  - 0.5.0
  - 0.5.1
  - 0.5.2
  - 0.5.3
  - 0.5.4
  - 0.6.0
  - 0.7.0
  - 0.7.1