What’s Vulnerable › Vulnerabilities

CVE-2022-31136: Cross-site Scripting in BookWyrm

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-07 · updated 2026-06-17
• Weakness: CWE-79

Description

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as cross site scripting attacks on users viewing these fields. Users are advised to upgrade to version 0.4.1. There are no known workarounds for this issue.

Affected products

• bookwyrm-social bookwyrm: before 0.4.1 — fixed in 0.4.1

How to fix

Upgrade to a fixed version: bookwyrm-social bookwyrm 0.4.1. Check the vendor advisory for mitigations.

References

• https://github.com/bookwyrm-social/bookwyrm/commit/fe33fdcf564a6a5667aef75d5456bea08feab50d
• https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-2cfh-v7rf-pxfp
• https://github.com/bookwyrm-social/bookwyrm/commit/fe33fdcf564a6a5667aef75d5456bea08feab50d
• https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-2cfh-v7rf-pxfp

Get alerted when CVE-2022-31136 or the next vulnerability affects your stack