Read the docs
TI-2024-27719 Aliases CVE-2024-41656GHSA-fm88-hc3v-3www

Sentry vulnerable to stored Cross-Site Scripting (XSS)

Priority LOW 34CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page. Self-hosted Sentry users may be impacted in case of untrustworthy Integration platform integrations sending external issues from their side to Sentry. A patch has been released in Sentry 24.7.1. For Sentry SaaS customers, no action is needed. This has been patched on July 23, and even prior to the fix, the exploitation was not possible due to the strict Content Security Policy deployed on sentry.io site. For self-hosted users, the maintainers of Sentry strongly recommend upgrading Sentry to the latest version. If it is not possible, one could enable CSP on one's self-hosted installation with `CSP_REPORT_ONLY = False` (enforcing mode). This will mitigate the risk of cross-site scripting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00467 40th percentileScored 2026-11-07
Fix Fixed sentry (getsentry): 24.7.1sentry (PyPI): 24.7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getsentrysentry10.0.0 to before 24.7.124.7.1Patch availableCNA
—sentry (PyPI)10.0.0 to before 24.7.124.7.1Patch availableGHSA-fm88-hc3v-3www
  • sentry Vendorgetsentry Affected 10.0.0 to before 24.7.1 Fixed in 24.7.1 Patch available CNA
  • sentry (PyPI) Vendor— Affected 10.0.0 to before 24.7.1 Fixed in 24.7.1 Patch available GHSA-fm88-hc3v-3www

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*10.0.0 to before 24.7.1VulnerableSentry
  • cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:* Versions 10.0.0 to before 24.7.1 Vulnerable ·Sentry

Remediation

  • Fix · CNA sentry (getsentry) Fixed in 24.7.1
  • Fix · GHSA-fm88-hc3v-3www sentry (PyPI) Fixed in 24.7.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41656
  2. 2026-10-03 Alias added: GHSA-fm88-hc3v-3www

References

Patch 2

Advisory 2

Other 2

  • TI-2026-21018 Sentry allows unauthorized access to event data across organizational boundaries CVSS 4.0MEDIUM 5.7
  • TI-2026-30656 Sentry: Improper authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.8
  • TI-2026-78982 Sentry-Javascript: Middleware Bypass when using Tunnel route CVSS 4.0CRITICAL 9.1
  • TI-2025-16094 Improper authentication on SAML SSO process allows user impersonation in sentry CVSS 3.1CRITICAL 9.1
  • TI-2023-25212 Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint CVSS 3.1CRITICAL 9.3
  • TI-2026-21634 Sentry: Improper Authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.1
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences