The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| fava(PyPI) | 0 | 1.22 | N/A |
CVSS Metrics
