# CVE-2020-15883: managedinstalls XSS — Fixed in 2.6

🐘

🐘 Packagist

Not in CISA KEV

MEDIUM severity

# CVE-2020-15883 — managedinstalls

MEDIUM [Fix: munkireport/managedinstalls@708f6a2](https://github.com/munkireport/managedinstalls/commit/708f6a2abc4b80a3751bcc9cf896f80d84250c55)

CVE-2020-15883 is a medium-severity (CVSS 6.1) Cross-site Scripting (XSS) vulnerability in munkireport/managedinstalls. A fix is available for munkireport/managedinstalls — see the affected versions and patch details below.

MunkiReport Managed Installs module Reflected Cross-Site Scripting (XSS) vulnerability

Also known as[GHSA-79xr-v794-wq35](/vulnerability/GHSA-79xr-v794-wq35)

Published

Jul 23, 2020

Updated

Oct 20, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

1.2%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs67th percentile — riskier than 67% of all scored CVEsHighest risk

0.03%0.57%1.12%1.66%0.5%1.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

1 pkg affected

🐘`munkireport/managedinstalls`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

## Description

A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported).

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

🐘Packagist

`munkireport/managedinstalls` 

all versions

2.6`composer require munkireport/managedinstalls:^2.6`

## Affected Products

1 product · 1 configurations

Application

`managedinstalls`managedinstalls\_project

< 2.6

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for munkireport/managedinstalls, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update munkireport/managedinstalls to 2.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2020-15883 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
    

## Frequently Asked Questions

A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported).

O3 Security · Impact-Aware SCA

### Is CVE-2020-15883 in your dependencies?

Find it across Packagist, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)