Medium severity6.1NVD Advisory· Published Jun 17, 2018· Updated Jun 17, 2026
CVE-2018-12104
CVE-2018-12104
Description
Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/new_report.kp URI.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
knowledge-repoPyPI | < 0.9.0 | 0.9.0 |
Affected products
2- cpe:2.3:a:airbnb:knowledge_repo:0.7.4:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
10- github.com/airbnb/knowledge-repo/issues/431nvdExploitMitigationThird Party AdvisoryWEB
- www.securityfocus.com/bid/104487nvdThird Party AdvisoryVDB Entry
- github.com/advisories/GHSA-xmw7-848p-p95wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-12104ghsaADVISORY
- github.com/airbnb/knowledge-repo/commit/f026ad2afea14e0ffc91f1aa0eaedcdc72c63167ghsaWEB
- github.com/airbnb/knowledge-repo/issues/254ghsaWEB
- github.com/airbnb/knowledge-repo/pull/558ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/knowledge-repo/PYSEC-2018-116.yamlghsaWEB
- pypi.org/project/knowledge-repoghsaWEB
- web.archive.org/web/20200227121013/http://www.securityfocus.com/bid/104487ghsaWEB
News mentions
0No linked articles in our index yet.