CVE-2025-2361
# HG changeset patch
# User Raphaël Gomès <rgomes@octobus.net>
# Date
1742340720 -3600
# Wed Mar 19 00:32:00 2025 +0100
# Branch stable
# Node ID
a5c72ed2929341d97b11968211c880854803f003
# Parent
74439d1cbebaa9ff8f8300e37e93b42e6d381be4
hgweb: fix XSS vulnerability in hgweb (CVE-2025-2361)
818598f5bc8b91 is the change that introduced the vulnerability (in 2006!)
that was disclosed to us, but I found a similar pattern in other places
in the code.
Since XSS escaping is actually hard and that would mean vendoring some
better sanitation tool, I decided to simply remove user input from any
HTML output in hgweb, hopefully in all places.
Gbp-Pq: Name CVE-2025-2361.patch
projects / mercurial.git / commit