CVE-2009-2959

Buildbot Cross-site scripting (XSS) vulnerability

4.3 MediumFix available

CVE-2009-2959 is a medium vulnerability (CVSS 4.3) in Buildbot, published August 25, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.01%, the 80th percentile. Fixed in buildbot 0.7.11p3.

Cross-site scripting (XSS) vulnerability in the waterfall web status view (status/web/waterfall.py) in Buildbot 0.7.6 through 0.7.11p1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Exploit likelihood

2.01%Up 0.6 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2009-2959
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-2959
Updated: 2026-11-02

EUVDEUVD-2009-0001 No score

Record: EUVD-2009-0001
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jqqh-999x-w26w 5.3

Buildbot Cross-site scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in the waterfall web status view (status/web/waterfall.py) in Buildbot 0.7.6 through 0.7.11p1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: GHSA-jqqh-999x-w26w
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-jqqh-999x-w26w 5.3

Buildbot Cross-site scripting (XSS) vulnerability

Record: GHSA-jqqh-999x-w26w
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

Record: CVE-2009-2959
Updated: 2026-11-02

OSVDEBIAN-CVE-2009-2959 No score

Record: DEBIAN-CVE-2009-2959
Updated: 2026-11-02

OSVPYSEC-2009-1 No score

Record: PYSEC-2009-1
Updated: 2026-11-02

Affected products

buildbot

Affected packages

Affected packages
Package	Affected	Fixed
`buildbot` PyPI	0.7.6 up to 0.7.11p3	0.7.11p3
`buildbot` Debian:12	before 0.7.11p3-1	0.7.11p3-1
`buildbot` Debian:13	before 0.7.11p3-1	0.7.11p3-1
`buildbot` Debian:14	before 0.7.11p3-1	0.7.11p3-1
`buildbot` PyPI	0.7.6 up to 0.7.11p3, plus listed versions 0.7.100.7.110.7.120.7.70.7.8 Show 45 moreShow less 0.7.90.8.00.8.10.8.100.8.120.8.130.8.140.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.90.9.00.9.0.post10.9.0b10.9.0b20.9.0b30.9.0b40.9.0b50.9.0b60.9.0b70.9.0b80.9.0b90.9.0rc10.9.0rc20.9.0rc30.9.0rc40.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.15.post10.9.20.9.30.9.40.9.50.9.60.9.70.9.8	0.7.11p3
`buildbot` PyPI	0.7.6 up to 0.7.12, plus listed versions 0.7.100.7.110.7.70.7.80.7.9	0.7.12

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 12 moreShow less

This page doesn't list everything

Left out here: 81 versions. The JSON record has them.