Medium severity6.3NVD Advisory· Published Jul 7, 2022· Updated Jun 17, 2026
CVE-2022-31136
CVE-2022-31136
Description
Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as cross site scripting attacks on users viewing these fields. Users are advised to upgrade to version 0.4.1. There are no known workarounds for this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<0.4.1+ 1 more
- (no CPE)range: <0.4.1
- (no CPE)range: < 0.4.1
Patches
Vulnerability mechanics
References
2- github.com/bookwyrm-social/bookwyrm/commit/fe33fdcf564a6a5667aef75d5456bea08feab50dnvdPatchThird Party Advisory
- github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-2cfh-v7rf-pxfpnvdThird Party Advisory
News mentions
0No linked articles in our index yet.