All the vulnerabilities related to the version 0.4.0 of the package
xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False
on xhr.open
), malicious user input flowing into xhr.send
could result in arbitrary code being injected and run.