CVE-2023-49277 json
Reflected Cross-site Scripting Vulnerability in dpaste
published 2023-12-01 2 y ago modified 2026-09-10 1 mo ago also GHSA-r8j9-5cj7-cv39 , PYSEC-2026-1317 , EUVD-2023-3285
- cvss
- 8.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. Users are strongly advised to upgrade to dpaste release v3.8 or later versions, as dpaste versions older than v3.8 are susceptible to the identified security vulnerability. No known workarounds have been identified, and applying the patch is the most effective way to remediate the vulnerability.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | dpaste | <3.8 |
3.8 |
Affected products
- DarrenOfficial dpaste
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086
web, patch
-
github.com
/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-49277
advisory
-
github.com
/DarrenOfficial/dpaste
package
-
pypi.org
/project/dpaste
package
-
github.com
/advisories/GHSA-r8j9-5cj7-cv39
advisory
Sources
- CVE List CVE-2023-49277
- GitHub Advisory GHSA-r8j9-5cj7-cv39
- NVD CVE-2023-49277
- OSV PYSEC-2026-1317
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.