CVE-2019-16935The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field.
Updated under an hour ago ()
Does this affect you?
It affects python and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.
- CVSS
- 6.1 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Modified
- Record last updated
- Oct 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
python python python:python | from 2.7.0 before 2.7.17; from 3.0.0 before 3.5.8; from 3.6.0 before 3.6.10; from 3.7.0 before 3.7.5 | NVD |
debian debian_linux debian:debian_linux | 9.0 | NVD |
canonical ubuntu_linux canonical:ubuntu_linux | 12.04; 14.04; 16.04; 18.04; 19.04 | NVD |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.htmlmailing-list, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.htmlmailing-list, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.htmlmailing-list, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.htmlmailing-list, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlmailing-list, third-party-advisory
- https://bugs.python.org/issue38243exploit, vendor-advisory
- https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897third-party-advisory
- https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213third-party-advisory
- https://github.com/python/cpython/pull/16373exploit, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2020/07/msg00011.htmlmailing-list, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2021/04/msg00015.htmlmailing-list, third-party-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/
- https://security.netapp.com/advisory/ntap-20191017-0004/third-party-advisory
- https://usn.ubuntu.com/4151-1/third-party-advisory
- https://usn.ubuntu.com/4151-2/third-party-advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.