# CVE-2022-2514: Beancount Fava reflected XSS in time and filter parameters

Source: https://junglewise.ai/threats/cve-2022-2514-beancount-fava-reflected-xss-in-time-and-filter-parameters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-07-26. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2022-2514 · Severity: medium · CVSS 6.1 · Published 2022-07-26

Fava, a web interface for the Beancount accounting tool, is vulnerable to a security flaw where malicious code can be injected into the application. An attacker could trick a user into clicking a specially crafted link, allowing the attacker to execute scripts in the user's browser session. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Technologies: [fava (PyPI)](https://junglewise.ai/threats/technologies/fava). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-2514 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-2514 being exploited in the wild.

**How severe is CVE-2022-2514?** Medium severity, with a CVSS score of 6.1, published 26 July 2022.

**Which products and versions are affected?** fava (PyPI) >= 0, < 1.22, ECOSYSTEM:introduced=0,fixed=1.22, GIT:introduced=0,fixed=ca9e3882c7b5fbf5273ba52340b9fea6a99f3711|ECOSYSTEM:introduced=0,fixed=1.22.

**Is there a fix for CVE-2022-2514?** Yes. fava (PyPI): upgrade to 1.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-2514 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2022-2514?** Check whether you run fava (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fava (PyPI): upgrade to 1.22 or later

  ```sh
  pip install "fava>=1.22"
  ```


## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Fava prior to version 1.22. The vulnerability is located in the handling of 'time' and 'filter' parameters, where error messages containing these parameters were rendered in the UI without proper HTML escaping. An attacker can exploit this by crafting a malicious URL containing JavaScript and persuading a victim to visit it. The root cause was the use of the '|safe' filter in Jinja2 templates and a general lack of output encoding for error strings. Successful exploitation allows for arbitrary script execution in the context of the victim's browser. A fix is available in version 1.22 which removes unsafe template filters and ensures proper escaping.

## Affected products

- beancount fava < 1.22

## Identifiers

- CVE-2022-2514
- GHSA-xrf4-39fm-j5f2
- PYSEC-2022-239
- PYSEC-2022-43182

## Timeline

- 2022-07-25: advisory: NVD published CVE-2022-2514
- 2022-07-26: disclosed: GitHub Advisory published
- 2022-07-26: patched: Version 1.22 released

## References

- [https://github.com/beancount/fava/commit/ca9e3882c7b5fbf5273ba52340b9fea6a99f3711](https://github.com/beancount/fava/commit/ca9e3882c7b5fbf5273ba52340b9fea6a99f3711)
- [https://huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429](https://huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429)
- [https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-239.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-239.yaml)
- [https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-43182.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-43182.yaml)

## Related threats

- [PYSEC-2022-246 - Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3.](https://junglewise.ai/threats/cve-2022-2589-fava-vulnerable-to-reflected-cross-site-scripting)
- [PYSEC-2022-240 - Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.](https://junglewise.ai/threats/cve-2022-2523-fava-vulnerable-to-reflected-cross-site-scripting)