Chuck b7295129b5 fix(security): escape plugin_id in XSS-vulnerable 404 partial; bump Pillow past CVE-2023-50447 ...

pages_v3.py: plugin_id is taken directly from the URL path and was
interpolated into a returned HTML fragment without escaping. A crafted
URL like /partials/plugin-config/<script>alert(1)</script> would inject
arbitrary HTML into any page that loads this HTMX partial.
Fix: wrap with html.escape() from the stdlib.

march-madness/requirements.txt: Pillow>=9.1.0 is vulnerable to
CVE-2023-50447 (arbitrary code execution via the environment parameter).
Bump minimum to >=10.2.0 which contains the fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-03 08:32:17 -04:00

..

config_schema.json

feat(march-madness): add NCAA tournament plugin and round logos (#263)

2026-02-24 18:32:22 -05:00

manager.py

fix(web): render file-upload drop zone for string-type config fields (#271)

2026-02-24 20:12:31 -05:00

manifest.json

feat(march-madness): add NCAA tournament plugin and round logos (#263)

2026-02-24 18:32:22 -05:00

requirements.txt

fix(security): escape plugin_id in XSS-vulnerable 404 partial; bump Pillow past CVE-2023-50447

2026-05-03 08:32:17 -04:00