CVE-2019-10904

CVE-2019-10904 describes a reflected cross-site scripting (XSS) vulnerability in Roundup 1.6. The bug originates from improper handling of 404 errors in the files frontends/roundup.cgi and roundup/cgi/wsgi_handler.py. When a non-existent URL is requested, the path is reflected in the 404 error page without sanitization, enabling script injection [1].

An attacker can exploit this by crafting a URL containing a malicious payload, such as ``. If a victim clicks the link (or is redirected), the browser executes the payload in the context of the Roundup instance, leading to XSS [2]. No authentication is required; the attack is reflected and self-contained within the vulnerable page.

Successful exploitation allows an attacker to perform actions on behalf of the victim, steal cookies, or deface the site. The full impact depends on the application's trust level and data sensitivity [4].

The vulnerability was reported to the Roundup project and fixed in the repository (commit available) but no official release has been made as of the publication date. Users are advised to apply the patch manually or restrict access to vulnerable endpoints [2].