CVE-2024-27291: Docassemble open redirect

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-21 · updated 2026-06-17
Weakness: CWE-601

Description

Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, it is possible to create a URL that acts as an open redirect. The vulnerability has been patched in version 1.4.97 of the master branch.

Affected products

jhpyle docassemble: before 1.4.97 — fixed in 1.4.97

How to fix

Upgrade to a fixed version: jhpyle docassemble 1.4.97. Check the vendor advisory for mitigations.

References

https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac09523077930cdb6dea2aa
https://github.com/jhpyle/docassemble/security/advisories/GHSA-7wxf-r2qv-9xwr
https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac09523077930cdb6dea2aa
https://github.com/jhpyle/docassemble/security/advisories/GHSA-7wxf-r2qv-9xwr

Get alerted when CVE-2024-27291 or the next vulnerability affects your stack