Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The HTML and RSS output handlers in dosagelib/events.py write user-controlled content (comic text and page URLs) directly into generated files without proper HTML escaping. When a user scrapes a malicious webcomic and opens the generated HTML/RSS file, attacker-controlled JavaScript can execute in their browser. CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) --- Details Vulnerable Code Locations The vulnerability exists in dosagelib/events.py where untrusted content is written to HTML/RSS output without escaping: 1. RSSEventHandler (lines 116-118) 2. HtmlEventHandler (lines 232, 238) Root Cause - BasicScraper.fetchText() in scraper.py:422 calls html.unescape() on extracted text - The output handlers never call html.escape() before writing to files - No sanitization of URLs or text content occurs anywhere in the output pipeline Data Flow --- PoC I created a proof-of-concept that demonstrates the vulnerability by simulating a…
Recommended action: Upgrade to 3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When downloadinging comic images, Dosage constructs target file names from different aspects of the remote comic (page URL, image URL, page content, etc.). While the basename is properly stripped of directory-traversing characters, the file extension is taken from the HTTP Content-Type header. This allows a remote attacker (or a Man-in-the-Middle, if the comic is served over HTTP) to write arbitrary files outside the target directory (if additional conditions are met). Patches Fixed in release 3.2. The fix is small and self-contained, so distributors might elect to backport the fix to older versions. Workarounds No
Recommended action: Upgrade to 3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.