Moderate severityNVD Advisory· Published Feb 28, 2024· Updated Aug 8, 2024
Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
CVE-2024-27083
Description
Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
Flask-AppBuilderPyPI | >= 4.1.4, < 4.2.1 | 4.2.1 |
Affected products
1- Range: >= 4.1.4, < 4.2.1
Patches
13d17741886e4fix: Make sure user input is not treated as safe in the oauth view (#1978)
1 file changed · +1 −1
flask_appbuilder/templates/appbuilder/general/security/login_oauth.html+1 −1 modified@@ -6,7 +6,7 @@ <script type="text/javascript"> var baseLoginUrl = "{{appbuilder.get_url_for_login}}"; var baseRegisterUrl = "{{appbuilder.get_url_for_login}}"; - var next = "?next=" + encodeURIComponent("{{request.args.get('next', '') | safe}}"); + var next = "?next=" + encodeURIComponent("{{request.args.get('next', '')}}"); function signin(provider) { window.location.href = baseLoginUrl + provider + next;
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-fqxj-46wg-9v84ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-27083ghsaADVISORY
- github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812ghsax_refsource_MISCWEB
- github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fqxj-46wg-9v84ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.