CVE-2017-16043
HTML Injection in shout
Shout is an IRC client. Because the /topic command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Shout is an IRC client. Because the /topic command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
- Record
CVE-2017-16043- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-80, CWE-74
- Updated
- 2026-11-02
CVE List No score
Shout is an IRC client. Because the /topic command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
- Record
CVE-2017-16043- Weakness
- CWE-80
- Updated
- 2026-11-02
EUVDEUVD-2018-0723 No score
Shout is an IRC client. Because the /topic command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
- Record
EUVD-2018-0723- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-26q7-g57v-mxcp No score
HTML Injection in shout
Affected versions of shout do not escape the /topic command in messages, and are therefore vulnerable to cross-site scripting.
Recommendation
Update to version 0.50.0 or later.
- Record
GHSA-26q7-g57v-mxcp- Weakness
- CWE-80
- Updated
- 2026-11-02
OSV
Shout is an IRC client. Because the /topic command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
- Record
CVE-2017-16043- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-26q7-g57v-mxcp No score
HTML Injection in shout
Affected versions of shout do not escape the /topic command in messages, and are therefore vulnerable to cross-site scripting.
Recommendation
Update to version 0.50.0 or later.
- Record
GHSA-26q7-g57v-mxcp- Weakness
- CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16043 is a medium vulnerability (CVSS 6.1) in Shout Project Shout, published June 4, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in shout 0.50.0.