CVE-2022-46151: Reflected XSS

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-06 · updated 2026-06-17
Weakness: CWE-79

Description

Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/server/app/auth/oauth_auth.py` and `querybook/server/app/auth/okta_auth.py`. This may allow attackers to perform reflected cross site scripting (XSS) if Content Security Policy (CSP) is not enabled or `unsafe-inline` is allowed. Users are advised to upgrade to the latest, patched version of querybook (version 3.14.2 or greater). Users unable to upgrade may enable CSP and not allow unsafe-inline or manually escape query parameters in a reverse proxy.

Affected products

pinterest querybook: before 3.14.2 — fixed in 3.14.2

How to fix

Upgrade to a fixed version: pinterest querybook 3.14.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-46151 or the next vulnerability affects your stack