CVE-2024-36110
Cross-site scripting in ansibleguy-webui
ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Cross-site scripting in ansibleguy-webui
ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues.
- Record
CVE-2024-36110- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-1534
ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues.
- Record
EUVD-2024-1534- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-927p-xrc2-x2gj
ansibleguy-webui Cross-site Scripting vulnerability
Impact
Multiple forms in version <0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser.
Patches
We recommend to upgrade to version >= 0.0.21
References
- Record
GHSA-927p-xrc2-x2gj- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues.
- Record
CVE-2024-36110- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-site scripting in ansibleguy-webui
ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues.
- Record
CVE-2024-36110- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-927p-xrc2-x2gj
ansibleguy-webui Cross-site Scripting vulnerability
Impact
Multiple forms in version <0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser.
Patches
We recommend to upgrade to version >= 0.0.21
References
- Record
GHSA-927p-xrc2-x2gj- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2026-1126
ansibleguy-webui Cross-site Scripting vulnerability
Impact
Multiple forms in version <0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser.
Patches
We recommend to upgrade to version >= 0.0.21
References
- Record
PYSEC-2026-1126- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ansibleguy-webuiPyPI |
before 0.0.21 | 0.0.21 |
ansibleguy-webuiPyPI |
before 0.0.21, plus listed versions 0.0.150.0.160.0.170.0.180.0.190.0.20 |
0.0.21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-36110 is a high vulnerability (CVSS 8.2) in Ansibleguy Webui, published May 28, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 35th percentile. Fixed in ansibleguy-webui 0.0.21.
References
github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj
nvd.nist.gov/vuln/detail/CVE-2024-36110
pypi.org/project/ansibleguy-webui