CVE-2020-15118

Advisory

Wagtail 2.7.4 includes a fix for CVE-2020-15118 to prevent HTML injection through the form field help text.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

~~~~~~~~~~~~~~~~~~

* Fix: CVE-2020-15118 - prevent HTML injection through form field help text (Timothy Bautista, Matt Westcott)
* Fix: Expand Pillow dependency range to include 7.x (Harris Lapiroff, Matt Westcott)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15118
• https://docs.wagtail.io/en/stable/reference/contrib/forms/index.html#usage
• https://github.com/wagtail/wagtail/blob/master/docs/releases/2.9.3.rst
• https://github.com/wagtail/wagtail/security/advisories/GHSA-2473-9hgq-j7xw
• https://github.com/wagtail/wagtail/commit/d9a41e7f24d08c024acc9a3094940199df94db34
• https://docs.djangoproject.com/en/3.0/ref/models/fields/#django.db.models.Field.help_text