# roundup (PyPI) vulnerabilities

15 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pypi.org/project/roundup/

## Advisories (15)

### [CVE-2025-53865](https://cve.now/CVE-2025-53865): In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

- Severity: Medium 6.4
- Published: Jul 13, 2025
- Affected: fixed in 2.5.0.

### [CVE-2024-39126](https://cve.now/CVE-2024-39126): Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.

- Severity: Medium 5.4
- Published: Jul 17, 2024
- Affected: fixed in 2.4.0.

### [CVE-2024-39125](https://cve.now/CVE-2024-39125): Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.

- Severity: Medium 5.4
- Published: Jul 17, 2024
- Affected: fixed in 2.4.0.

### [CVE-2024-39124](https://cve.now/CVE-2024-39124): In Roundup before 2.4.0, classhelpers (\_generic.help.html) allow XSS.

- Severity: Medium 6.1
- Published: Jul 17, 2024
- Affected: fixed in 2.4.0.

### [CVE-2012-6133](https://cve.now/CVE-2012-6133): Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML…

- Severity: Unrated
- Published: Jan 30, 2020
- Affected: fixed in 1.4.20.

### [CVE-2019-10904](https://cve.now/CVE-2019-10904): Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi\_handler.py mishandle 404 errors.

- Severity: Unrated
- Published: Apr 6, 2019
- Affected: fixed in 2.0.0alpha0; fixed in 2.0.0.

### [CVE-2014-6276](https://cve.now/CVE-2014-6276): schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote…

- Severity: Unrated
- Published: Apr 13, 2016
- Affected: fixed in 1.5.1.

### [CVE-2012-6131](https://cve.now/CVE-2012-6131): Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script…

- Severity: Unrated
- Published: Apr 11, 2014
- Affected: fixed in 1.4.20.

### [CVE-2012-6130](https://cve.now/CVE-2012-6130): Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web…

- Severity: Unrated
- Published: Apr 11, 2014
- Affected: fixed in 1.4.20.

### [CVE-2012-6132](https://cve.now/CVE-2012-6132): Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the…

- Severity: Unrated
- Published: Apr 10, 2014
- Affected: fixed in 1.4.20.

### [CVE-2010-2491](https://cve.now/CVE-2010-2491): Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script…

- Severity: Unrated
- Published: Sep 24, 2010
- Affected: fixed in 1.4.14.

### [CVE-2009-2737](https://cve.now/CVE-2009-2737): The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly…

- Severity: Unrated
- Published: Aug 11, 2009
- Affected: from 1.2, fixed in 1.2.1; from 1.4, fixed in 1.4.7; from 1.2, fixed in 1.2.1; from 1.4, fixed in 1.4.7.

### [CVE-2008-1475](https://cve.now/CVE-2008-1475): The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read…

- Severity: Unrated
- Published: Mar 24, 2008
- Affected: fixed in 1.4.5.

### [CVE-2008-1474](https://cve.now/CVE-2008-1474): Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to…

- Severity: Unrated
- Published: Mar 24, 2008
- Affected: fixed in 1.4.4.

### [CVE-2004-1444](https://cve.now/CVE-2004-1444): Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via ..

- Severity: Unrated
- Published: Feb 13, 2005
- Affected: fixed in 0.7.3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/roundup
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.