VULNERABILITY INTELLIGENCE

CVE-2024-27290

CVSS score6.1 MEDIUM
EPSS probability0.43%
CISA KEVNot currently listed
Published2024-03-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The vulnerability has been patched in version 1.4.97 of the master branch.

Weakness classification

  • security-advisories@github.com: CWE-79

Primary references