VYPR
← All advisories
Moderate severityNVD Advisory· Published Jul 25, 2022· Updated Aug 3, 2024

Cross-site Scripting (XSS) - Reflected in beancount/fava

CVE-2022-2523

Description

Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Reflected XSS in Fava prior to 1.22.2 allows attackers to inject arbitrary JavaScript via crafted query filter parameters.

Vulnerability

Description CVE-2022-2523 is a reflected Cross-Site Scripting (XSS) vulnerability in the beancount/fava application, affecting versions prior to 1.22.2. The root cause is improper sanitization of user input in the query filter functionality: the inventory data was rendered using {@html ...} without escaping, allowing unvalidated HTML or JavaScript to be injected [1][2].

Exploitation

The vulnerability is exploitable over the network with low attack complexity and no required privileges. An attacker can craft a malicious URL containing a query filter with embedded JavaScript. When a victim visits this URL, the script executes in the context of the Fava application, potentially leading to data theft, session hijacking, or unauthorized actions [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, compromising the confidentiality and integrity of user data. The CVSS v3.1 base score is 8.1 (High) [1].

Mitigation

The issue was fixed in commit dccfb6a2f4567f35ce2e9a78e24f92ebf946bc9b, and the fix is included in version 1.22.2. Users are strongly advised to upgrade to the latest version [3][4]. No workarounds are specified.

References
  1. CVE-2022-2523 - GitHub Advisory Database
  2. NVD - CVE-2022-2523
  3. advisory-database/vulns/fava/PYSEC-2022-240.yaml at main · pypa/advisory-database
  4. fix xss issue in query filter · beancount/fava@dccfb6a

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
favaPyPI
< 1.22.21.22.2

Affected products

3

Patches

1
dccfb6a2f456

fix xss issue in query filter

https://github.com/beancount/favaJakob SchnitzerJul 23, 2022via ghsa
commit
2 files changed · +9 −3
  • frontend/src/modals/EntryContext.svelte+8 −2 modified
    @@ -35,7 +35,10 @@
             <tr>
               <td><a href={urlForAccount(account)}>{account}</a></td>
               <td>
-                {@html inventory.join("<br>")}
+                {#each inventory as amount}
+                  {amount}
+                  <br />
+                {/each}
               </td>
             </tr>
           {/each}
@@ -52,7 +55,10 @@
             <tr>
               <td><a href={urlForAccount(account)}>{account}</a></td>
               <td>
-                {@html inventory.join("<br>")}
+                {#each inventory as amount}
+                  {amount}
+                  <br />
+                {/each}
               </td>
             </tr>
           {/each}
  • frontend/src/query/Query.svelte+1 −1 modified
    @@ -106,7 +106,7 @@
           {/if}
           {@html result.table}
         {:else if error}
-          {@html error}
+          {error}
         {/if}
       </div>
     </details>

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.