PVE-2025-75464

Advisory

Confidant fixes potential XSS from API call by enforcing strict HTTP response headers.

[This advisory has been limited. Please create a free account to view the full advisory.]

Affected package

Affected versions

Fixed versions

Vulnerability changelog

* XSS security fix / enhancement for Flask API response

[This text has been limited. Please create a free account to view the full text.]

Resources

• https://github.com/lyft/confidant/commit/8876b07abde0c8d2a4974f79b60562b6d0193db9#diff-be5c9a04642c9737b71cc1046c1e587bdc9a836fbf3b13b18c7f3745e14f13a0
• https://github.com/lyft/confidant/pull/436
• https://pypi.org/project/confidant
• https://data.safetycli.com/changelogs/confidant/