An authenticated user could store crafted (including HTML-entity-encoded) content in fields like the profile Bio; _lms.py decoded it via BeautifulSoup.get_text() and rendered it unescaped into the server response, executing arbitrary JavaScript for any visitor, including unauthenticated guests. Fixed by re-encoding server-side (escape_html) and escaping all metadata/SEO output in the template; patched in 2.52.2.
nickhefty Reporter
supervillain419 Reporter
el-queso Reporter
An authenticated user could store crafted (including HTML-entity-encoded) content in fields like the profile Bio; _lms.py decoded it via BeautifulSoup.get_text() and rendered it unescaped into the server response, executing arbitrary JavaScript for any visitor, including unauthenticated guests. Fixed by re-encoding server-side (escape_html) and escaping all metadata/SEO output in the template; patched in 2.52.2.