Read the docs
TI-2021-17971 Aliases CVE-2021-41132GHSA-g67g-hvc3-xmvf

Inconsistent input sanitisation leads to XSS vectors

Priority MEDIUM 44CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.

Why it matters now

EPSS 0.01039 64th percentileScored 2026-11-07
Fix Fixed omero-web (ome): 5.11.0omero-web (PyPI): 5.11.0+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
omeomero-webbefore 5.11.05.11.0Patch availableCNA
—omero-web (PyPI)before 5.11.05.11.0Patch availableGHSA-g67g-hvc3-xmvf
—omero-figure (PyPI)before 4.4.14.4.1Patch availableGHSA-g67g-hvc3-xmvf
  • omero-web Vendorome Affected before 5.11.0 Fixed in 5.11.0 Patch available CNA
  • omero-web (PyPI) Vendor— Affected before 5.11.0 Fixed in 5.11.0 Patch available GHSA-g67g-hvc3-xmvf
  • omero-figure (PyPI) Vendor— Affected before 4.4.1 Fixed in 4.4.1 Patch available GHSA-g67g-hvc3-xmvf

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openmicroscopy:omero-figure:*:*:*:*:*:*:*:*before 4.4.1Vulnerableome
cpe:2.3:a:openmicroscopy:omero-web:*:*:*:*:*:*:*:*before 5.11.0Vulnerableome
  • cpe:2.3:a:openmicroscopy:omero-figure:*:*:*:*:*:*:*:* Versions before 4.4.1 Vulnerable ·ome
  • cpe:2.3:a:openmicroscopy:omero-web:*:*:*:*:*:*:*:* Versions before 5.11.0 Vulnerable ·ome

Remediation

  • Fix · CNA omero-web (ome) Fixed in 5.11.0
  • Fix · GHSA-g67g-hvc3-xmvf omero-web (PyPI) Fixed in 5.11.0 Advisory →
  • Fix · GHSA-g67g-hvc3-xmvf omero-figure (PyPI) Fixed in 4.4.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41132
  2. 2026-10-03 Alias added: GHSA-g67g-hvc3-xmvf

References

Patch 1

Advisory 3

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences