Maloja error page XSS vulnerability
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
### Impact The error page for a missing path echoes the path back to the user. If this contains HTML, an attacker could execute a script on the user's machine inside the Maloja context and perform authorized actions like scrobbling or deleting scrobbles. This does not affect the security of your server. The exploit is purely client-side. Since there is very little incentive to mess with your scrobble data and it requires very specific targeting (an attacker would have to send a user a link to their own server), the severity rating might be misleading. ### Patches The Vulnerability is patched in 3.2.2
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | malojaserver (PyPI) | before 3.2.2 | 3.2.2 | Patch available | GHSA-4h72-34j6-j8x7 |
- malojaserver (PyPI) Vendor— Affected before 3.2.2 Fixed in 3.2.2 Patch available GHSA-4h72-34j6-j8x7
Remediation
- Fix · GHSA-4h72-34j6-j8x7 malojaserver (PyPI) Fixed in 3.2.2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-4h72-34j6-j8x7
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences