Skip to content

v32.5.2 (Security Release)

Compare
Choose a tag to compare
@tdruez tdruez released this 14 Aug 08:07
· 268 commits to main since this release

Security

This release addresses the security issue detailed below. We encourage all users of ScanCode.io to upgrade as soon as possible.

  • GHSA-6xcx-gx7r-rccj: Reflected Cross-Site Scripting (XSS) in license endpoint
    The license_details_view function was subject to cross-site scripting (XSS)
    attack due to inadequate validation and sanitization of the key parameter.
    The license views were migrated class-based views are the inputs are now properly
    sanitized.
    Credit to @0xmpij for reporting the vulnerability.

What's Changed

Full Changelog: v32.5.1...v32.5.2