{"cve":"CVE-2024-22417","nvd":{"published":"2024-01-23T18:15:18.860","modified":"2026-06-17T07:11:22.213","status":"Modified","description":"Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a `GET` request on lines 339-343 in `requests.py`. The returned contents of the URL are then passed to and reflected back to the user in the `send_file` function on line 484, together with the user-controlled `src_type`, which allows the attacker to control the HTTP response content type leading to a cross-site scripting vulnerability. An attacker could craft a special URL to point to a malicious website and send the link to a victim. The fact that the link would contain a trusted domain (e.g. from one of public Whoogle instances) could be used to trick the user into clicking the link. The malicious website could, for example, be a copy of a real website, meant to steal a person’s credentials to the website, or trick that person in another way. Version 0.8.4 contains a patch for this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/request.py#L339-L343","https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L465-L490","https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L466","https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L476","https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L479"],"products":["benbusby:whoogle_search"],"source":"nvd","synced_at":"2026-10-19T21:44:57.175229480+00:00"},"epss":{"cve":"CVE-2024-22417","score":0.00635,"percentile":0.50461,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-phg6-44m7-hx3h","url":"https://osv.dev/vulnerability/GHSA-phg6-44m7-hx3h","summary":"Whoogle Search Cross-site Scripting vulnerability","modified":"2024-03-14T20:56:47.258412Z","packages":[{"ecosystem":"PyPI","name":"whoogle-search","purl":"pkg:pypi/whoogle-search","ranges":["<0.8.4"],"fixed":["0.8.4"]}]},{"id":"PYSEC-2024-19","url":"https://osv.dev/vulnerability/PYSEC-2024-19","summary":"","modified":"2026-06-10T17:02:50.987412790Z","packages":[{"ecosystem":"PyPI","name":"whoogle-search","purl":"pkg:pypi/whoogle-search","ranges":["<0.8.4"],"fixed":["0.8.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}