CVE-2021-39286

6.1 mediumEPSS 0.7%

Medium (6.1) in webrecorder pywb. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in pywb 2.6.0.

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.

Severity

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-08-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-947x-pv47-pp3q	PyPI	pywb	<2.6.0	2.6.0
PYSEC-2021-120	PyPI	pywb	<2.6.0	2.6.0