CVE-2019-13122

A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.

• CWE-79

• http://jk.ozlabs.org/projects/patchwork/Vendor Advisory
• http://www.openwall.com/lists/oss-security/2019/07/05/1Mailing List, Third Party Advisory
• https://github.com/getpatchwork/patchwork/commits/masterThird Party Advisory
• https://github.com/getpatchwork/patchwork/releasesRelease Notes, Third Party Advisory
• https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.htmlMailing List, Vendor Advisory
• https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.htmlMailing List, Vendor Advisory
• https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.htmlVendor Advisory
• http://jk.ozlabs.org/projects/patchwork/Vendor Advisory
• http://www.openwall.com/lists/oss-security/2019/07/05/1Mailing List, Third Party Advisory
• https://github.com/getpatchwork/patchwork/commits/masterThird Party Advisory
• https://github.com/getpatchwork/patchwork/releasesRelease Notes, Third Party Advisory
• https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.htmlMailing List, Vendor Advisory
• https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.htmlMailing List, Vendor Advisory
• https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.htmlVendor Advisory

Published

Jul 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13116The MuleSoft Mule Community Edition runtime engine before 3.…9.8
• CVE-2019-13117In numbers.c in libxslt 1.1.33, an xsl:number with certain f…5.3
• CVE-2019-13118In numbers.c in libxslt 1.1.33, a type holding grouping char…5.3
• CVE-2019-1312Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-13120Amazon FreeRTOS up to and including v1.4.8 lacks length chec…7.5
• CVE-2019-13121An issue was discovered in GitLab Enterprise Edition 10.6 th…7.5
• CVE-2019-13123Foxit Reader 9.6.0.25114 and earlier has two unique Recursiv…7.5
• CVE-2019-13124Foxit Reader 9.6.0.25114 and earlier has two unique Recursiv…7.5
• CVE-2019-13125HaboMalHunter through 2.0.0.3 in Tencent Habo allows attacke…
• CVE-2019-13126An integer overflow in NATS Server before 2.0.2 allows a rem…7.5
• CVE-2019-13127An issue was discovered in mxGraph through 4.0.0, related to…
• CVE-2019-13128An issue was discovered on D-Link DIR-823G devices with firm…