CVE-2024-23341 json
TuiTse-TsuSin html injection vulnerability in `tuitse_html` function
published 2024-01-22 2 y ago modified 2026-09-10 1 mo ago also GHSA-m4m5-j36m-8x72 , PYSEC-2024-22 , EUVD-2024-0166
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using `tuitse_html` without quoting the input, there is a html injection vulnerability. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input with HTML quotation.
Patch / fix
- pypi tuitse-tsusin 1.3.2
- ithuan tuitse-tsusin 1.3.2
- github.com/i3thuan5/TuiTse-TsuSin@9d21d99 commit
- github.com/i3thuan5/TuiTse-TsuSin#22 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | tuitse-tsusin | <1.3.2 |
1.3.2 |
Affected products
- i3thuan5 TuiTse-TsuSin
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/i3thuan5/TuiTse-TsuSin/pull/22
web, issue-tracking, patch
-
github.com
/i3thuan5/TuiTse-TsuSin/commit/9d21d99d7cfcd7c42aade251fab98ec102e730ea
web, patch
-
github.com
/i3thuan5/TuiTse-TsuSin/security/advisories/GHSA-m4m5-j36m-8x72
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-23341
advisory
-
github.com
/i3thuan5/TuiTse-TsuSin
package
-
github.com
/pypa/advisory-database/tree/main/vulns/tuitse-tsusin/PYSEC-2024-22.yaml
web
Sources
- CVE List CVE-2024-23341
- GitHub Advisory GHSA-m4m5-j36m-8x72
- NVD CVE-2024-23341
- OSV PYSEC-2024-22
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.