Read the docs
TI-2016-08558 Aliases CVE-2016-10516GHSA-h2fp-xgx6-xh6f

Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py…

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 2 fixed, 6 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.

Why it matters now

EPSS 0.01985 80th percentileScored 2026-11-07
Fix Partial Werkzeug (PyPI): 0.11.11Red Hat: 1 advisoryRed Hat: 2 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Werkzeug (PyPI)before 0.11.110.11.11Patch availableGHSA-h2fp-xgx6-xh6f
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Werkzeug (PyPI) Vendor— Affected before 0.11.11 Fixed in 0.11.11 Patch available GHSA-h2fp-xgx6-xh6f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*before 0.11.11Vulnerablepallets
  • cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* Versions before 0.11.11 Vulnerable ·pallets

Remediation

  • Fix · GHSA-h2fp-xgx6-xh6f Werkzeug (PyPI) Fixed in 0.11.11 Advisory →

Red Hat 1 advisory

  • RHSA-2019:3172 Released 2019-10-22 · Red Hat rating Moderate
    Red Hat Satellite 6 security, bug fix, and enhancement update
    • Red Hat Satellite 6.6 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.6-2.el7sat +47
    • Red Hat Satellite Capsule 6.6 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.6-2.el7sat +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 1.3AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 6 (Juno)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 6 (Juno) InstallerAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Satellite 6.6Fixed RHSA-2019:3172
Red Hat Satellite Capsule 6.6Fixed RHSA-2019:3172

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-10516
  2. 2026-10-03 Alias added: GHSA-h2fp-xgx6-xh6f

References

Advisory 3

Other 6

  • TI-2019-10671 In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. CVSS 3.1HIGH 7.5
  • TI-2022-11856 Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers… CVSS 3.1CRITICAL 9.8
  • TI-2023-10880 Werkzeug may allow high resource usage when parsing multipart form data with many fields CVSS 3.1HIGH 7.5
  • TI-2024-22527 Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution CVSS 3.1HIGH 7.5
  • TI-2024-33234 Werkzeug possible resource exhaustion when parsing file data in forms CVSS 4.0MEDIUM 6.9
  • TI-2023-24778 Uncontrolled resource consumption in pallets werkzeug CVSS 3.1HIGH 8.0
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences