NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
CRITICAL severity

Inconsistent input sanitisation leads to XSS vectorsGHSA-g67g-hvc3-xmvf

CRITICALFix: ome/omero-web@0168067

GHSA-g67g-hvc3-xmvf is a critical-severity (CVSS 9.8) CWE-116 vulnerability in omero-web. A fix is available for omero-web — see the affected versions and patch details below.

Also known asCVE-2021-41132PYSEC-2021-372PYSEC-2021-379
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.0%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs64th percentile — riskier than 64% of all scored CVEsHighest risk
0.06%0.55%1.05%1.54%0.6%1.0%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected
🐍omero-web🐍omero-figure

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of jQuery.html(), there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIomero-weball versions5.11.0pip install --upgrade 'omero-web==5.11.0'
🐍PyPIomero-figureall versions4.4.1pip install --upgrade 'omero-figure==4.4.1'

Affected Products

2 products · 2 configurations
Application
omero-figureopenmicroscopy
< 4.4.1
range
Application
omero-webopenmicroscopy
< 5.11.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for omero-web, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update omero-web to 5.11.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g67g-hvc3-xmvf is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Background A variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of XSS possibilities with specially crafted input to a variety of fields. ### Impact OMERO.web before 5.11.0 and OMERO.figure before 4.4.1. ### Patches Users should upgrade OMERO.web to 5.11.0 or higher and OMERO.figure to 4.4.1 or higher.
O3 Security · Impact-Aware SCA

Is GHSA-g67g-hvc3-xmvf in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
Inconsistent input sanitisation leads to XSS vectors