CVE-2011-1158
feedparser Cross-site Scripting vulnerability
CVE-2011-1158 is a medium vulnerability (CVSS 4.3) in Mark Pilgrim Feedparser, published April 11, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.35%, the 83rd percentile. Fixed in feedparser 5.0.1.
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
- Record
CVE-2011-1158- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
- Record
CVE-2011-1158- Updated
- 2026-11-02
EUVDEUVD-2011-0016 No score
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
- Record
EUVD-2011-0016- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4m72-rmm9-2qjr
feedparser Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
- Record
GHSA-4m72-rmm9-2qjr- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-4m72-rmm9-2qjr
feedparser Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
- Record
GHSA-4m72-rmm9-2qjr- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
- Record
CVE-2011-1158- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-1158 No score
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
- Record
DEBIAN-CVE-2011-1158- Updated
- 2026-11-02
OSVPYSEC-2011-21 No score
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
- Record
PYSEC-2011-21- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
feedparserPyPI |
5.0 up to 5.0.1 | 5.0.1 |
feedparserDebian:12 |
before 5.0.1-1 | 5.0.1-1 |
feedparserDebian:13 |
before 5.0.1-1 | 5.0.1-1 |
feedparserDebian:14 |
before 5.0.1-1 | 5.0.1-1 |
feedparserPyPI |
before 5.0.1, plus listed versions 4.15.0 |
5.0.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2011/03/14/18
support.novell.com/security/cve/CVE-2011-1158.html
secunia.com/advisories/43730
code.google.com/p/feedparser/issues/detail?id=255
securityfocus.com/bid/46867
bugzilla.redhat.com/show_bug.cgi?id=684877
Show 11 moreShow less
lists.opensuse.org/opensuse-updates/2011-04/msg00026.html
bugzilla.novell.com/show_bug.cgi?id=680074
mandriva.com/security/advisories?name=MDVSA-2011:082
nvd.nist.gov/vuln/detail/CVE-2011-1158
github.com/advisories/GHSA-4m72-rmm9-2qjr
web.archive.org/web/20150523054015/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2011:082?name=MDVSA-2011:082
security-tracker.debian.org/tracker/CVE-2011-1158