Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

whatsapp-chat-exporter

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.4PyPIAmendedPublished

    Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats.

    GHSA-8c6x-g4fw-8rf4

    Affected
    • PyPI whatsapp-chat-exporter < 0.9.5
    Fixed in
    0.9.5· Vendor fix available
    Issue
    Impact A Cross-Site Scripting (XSS) vulnerability was found in the HTML output of chats. XSS is intended to be mitigated by Jinja's escape function. However, autoescape=True was missing when setting the environment. Although the actual impact is low, considering the HTML file is being viewed offline, an adversary may still be able to inject malicious payloads into the chat through WhatsApp. All users are affected. Patches The vulnerability is patched in 0.9.5. All users are strongly advised to update the exporter to the latest version. Workarounds No workaround is available. Please update the exporter to the latest version. References https://github.com/KnugiHK/WhatsApp-Chat-Exporter/commit/bfdc68cd6ad53ceecf132773f9aaba50dd80fe79 https://owasp.org/www-community/attacks/xss/

    Recommended action: Upgrade to 0.9.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →