Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint
Summary
In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist.
Details
In the /license/ endpoint, the license_details_view function is vulnerable to a potential cross-site scripting (XSS) attack due to inadequate validation and sanitization of the key parameter. This vulnerability arises when attempting to access a key with malicious javascript.
def license_details_view(request, key):
"""
Display all available information about a given license `key` followed by
the full license text.
"""
licenses = get_licenses()
try:
data = saneyaml.dump(licenses[key].to_dict())
text = licenses[key].text
except KeyError:
return HttpResponseNotFound(f"License {key} not found.") # Leads to cross-site scripting when key is malicious javascript
return HttpResponse(f"<pre>{data}</pre><hr><pre>{text}</pre>")PoC
- Access following endpoint on scancode.io instance: http://localhost/license/%3Cscript%3Ealert(document.cookie);%3C/script%3E/
Impact
Attackers can exploit the vulnerability to inject malicious scripts into the response generated by the license_details_view function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | scancodeio | < 32.5.2 | 32.5.2 |
References
- https://github.com/nexB/scancode.io/security/advisories/GHSA-6xcx-gx7r-rccj
- https://nvd.nist.gov/vuln/detail/CVE-2023-40024
- https://github.com/nexB/scancode.io
- https://github.com/nexB/scancode.io/blob/dd7769fbc97c84545579cebf1dc4838214098a11/CHANGELOG.rst#v3252-2023-08-14
- https://github.com/nexB/scancode.io/releases/tag/v32.5.2
- https://pypi.org/project/scancodeio
- https://github.com/advisories/GHSA-6xcx-gx7r-rccj
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- Python (PyPI)
- Package
scancodeio- Disclosed
- 15.08.2023
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1905 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-6xcx-gx7r-rccj - CC BY 4.0
Vulnerability history: scancodeio
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 08.2023 08.2023
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
Disclosures per year
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 0
-
Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.