CVE-2019-13122
A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids...
A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.
- Record
CVE-2019-13122- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.
- Record
CVE-2019-13122- Updated
- 2026-11-02
EUVDEUVD-2019-4659 No score
A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.
- Record
EUVD-2019-4659- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x839-gjmw-5j5v
A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids...
A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.
- Record
GHSA-x839-gjmw-5j5v- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-13122
A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.
- Record
ALPINE-CVE-2019-13122- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
OSV
A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.
- Record
CVE-2019-13122- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
patchworkAlpine:v3.10 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.11 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.12 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.13 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.14 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.15 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.16 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.17 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.18 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.19 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
patchworkAlpine:v3.20 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.21 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.22 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.23 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.24 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.7 |
1.1 up to 1.1.3-r1 | 1.1.3-r1 |
patchworkAlpine:v3.8 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
patchworkAlpine:v3.9 |
1.1 up to 2.0.1-r1 | 2.0.1-r1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-13122 is a medium vulnerability (CVSS 6.1) in Ozlabs Patchwork, published July 10, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile. Fixed in patchwork 2.0.1-r1.