CVE-2024-41810: HTML injection in HTTP redirect body
Vulnerability summary
CVE-2024-41810 is a medium (CVSS 6.1) vulnerability in twisted. EPSS estimates a 1.20% chance of exploitation in the next 30 days, higher than 68.2% of scored vulnerabilities.
Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 6Timeline
- 29-07-2024PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · PypiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.20%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.20% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web PageThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- twisted< 22.4.0-4+deb12u1 | < 24.7.0-1
PyPI1 product
- twisted< 046a164f89a0f08d3239ecebd750360f8914df33 | < 24.7.0rc1
Twisted1 product
- twisted≤ 24.3.0
Ubuntu1 product
- twisted< 13.2.0-1ubuntu1.2+esm3 | < 16.0.0-1ubuntu0.4+esm2 | < 17.9.0-2ubuntu0.3+esm1 | < 18.9.0-11ubuntu0.20.04.4 | < 22.1.0-2ubuntu2.5 | < 24.3.0-1ubuntu0.1
4 vendors · 4 products
References
10 links- github.com/twisted/twisted/security/advisories/GHSA-cf56-g6w6-pqq2X Refsource CONFIRMWEBAdvisoryREPORTVendor Advisory
- github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33X Refsource MISCWEBFIXPatch
- github.com/twisted/twistedPACKAGE