# graphite-web (PyPI) vulnerabilities

7 known vulnerabilities (3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 1.1.10 (May 22, 2022): affected by 3 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Weekly downloads: 548
- Dependents: 0
- Releases: 27 since 0.9.5 (Jan 7, 2010)
- Registry: https://pypi.org/project/graphite-web/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2022-4730: 0.9.5 to 1.1.10 (through the newest release)
- CVE-2022-4729: 0.9.5 to 1.1.10 (through the newest release)
- CVE-2022-4728: 0.9.5 to 1.1.10 (through the newest release)
- CVE-2017-18638: 0.9.5 to 1.1.5 (1.1.6 is outside it)
- CVE-2013-5943: 0.9.5 to 0.9.10 (0.9.11 is outside it)
- CVE-2013-5942: 0.9.5 to 0.9.10 (0.9.11 is outside it)
- CVE-2013-5093: 0.9.5 to 0.9.10 (0.9.11 is outside it)

## Advisories (7)

### [CVE-2022-4730](https://cve.now/CVE-2022-4730): Graphite Web Absolute Time Range cross site scripting

- Severity: Low 3.5
- Published: Dec 24, 2022
- Affected: through 1.1.10.
- No fix released. The latest release, 1.1.10, is still affected.

### [CVE-2022-4729](https://cve.now/CVE-2022-4729): Graphite Web Template Name cross site scripting

- Severity: Low 3.5
- Published: Dec 24, 2022
- Affected: through 1.1.10.
- No fix released. The latest release, 1.1.10, is still affected.

### [CVE-2022-4728](https://cve.now/CVE-2022-4728): Graphite Web Cookie cross site scripting

- Severity: Low 3.5
- Published: Dec 24, 2022
- Affected: through 1.1.10.
- No fix released. The latest release, 1.1.10, is still affected.

### [CVE-2017-18638](https://cve.now/CVE-2017-18638): send\_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF.

- Severity: Unrated
- Published: Oct 11, 2019
- Affected: fixed in 1.1.6.
- Fixed in 1.1.6 (released Oct 25, 2019, 14 days after disclosure).
- The latest release, 1.1.10, is not affected.

### [CVE-2013-5943](https://cve.now/CVE-2013-5943): Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow remote attackers to inject arbitrary web script or…

- Severity: Unrated
- Published: Sep 27, 2013
- Affected: fixed in 0.9.11.
- Fixed in 0.9.11 (released Aug 20, 2013, 38 days before disclosure).
- The latest release, 1.1.10, is not affected.

### [CVE-2013-5942](https://cve.now/CVE-2013-5942): Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a…

- Severity: Unrated
- Published: Sep 27, 2013
- Affected: from 0.9.5, fixed in 0.9.11.
- Fixed in 0.9.11 (released Aug 20, 2013, 38 days before disclosure).
- The latest release, 1.1.10, is not affected.

### [CVE-2013-5093](https://cve.now/CVE-2013-5093): The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely…

- Severity: Unrated
- Published: Sep 27, 2013
- Affected: from 0.9.5, fixed in 0.9.11.
- Fixed in 0.9.11 (released Aug 20, 2013, 38 days before disclosure).
- The latest release, 1.1.10, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/graphite-web
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.