What’s Vulnerable › Vulnerabilities

CVE-2024-27083: Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-29 · updated 2026-06-17
• Weakness: CWE-79

Description

Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.

Affected products

• dpgaspar Flask-AppBuilder: from 4.1.4 before 4.2.1 — fixed in 4.2.1

How to fix

Upgrade to a fixed version: dpgaspar Flask-AppBuilder 4.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fqxj-46wg-9v84
• https://github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fqxj-46wg-9v84

Get alerted when CVE-2024-27083 or the next vulnerability affects your stack