# CVE-2022-25303: Whoogle Search Cross-site Scripting via string parameter

Source: https://junglewise.ai/threats/cve-2022-25303-whoogle-search-cross-site-scripting-via-string-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-07-12  
License: CC BY 4.0 with a link back

CVE-2022-25303 · Severity: low · CVSS 3.1 · Published 2022-07-12

The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the [flask.render_template](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template) function. However, the error_message is rendered using the [| safe filter](https://jinja.palletsprojects.com/en/3.1.x/templates/working-with-automatic-escaping), meaning the user input is not escaped.

Technologies: [whoogle-search (PyPI)](https://junglewise.ai/threats/technologies/pypi-whoogle-search). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-25303 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25303 being exploited in the wild.

**How severe is CVE-2022-25303?** Low severity, with a CVSS score of 3.1, published 12 July 2022.

**Which products and versions are affected?** whoogle-search (PyPI) ECOSYSTEM:introduced=0,fixed=0.7.2, GIT:introduced=0,fixed=abc30d7da3b5c67be7ce84d4699f327442d44606|ECOSYSTEM:introduced=0,fixed=0.7.2.

**Is there a fix for CVE-2022-25303?** Yes. whoogle-search (PyPI): upgrade to 0.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2022-25303?** Check whether you run whoogle-search (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- whoogle-search (PyPI): upgrade to 0.7.2 or later

  ```sh
  pip install "whoogle-search>=0.7.2"
  ```


## Affected products

- whoogle-search (PyPI) ECOSYSTEM:introduced=0,fixed=0.7.2, GIT:introduced=0,fixed=abc30d7da3b5c67be7ce84d4699f327442d44606|ECOSYSTEM:introduced=0,fixed=0.7.2

## Identifiers

- CVE-2022-25303
- GHSA-mxvc-fwgx-j778
- PYSEC-2022-226

## Related threats

- [PYSEC-2026-2048 - Whoogle allows attackers to execute arbitrary code via supplying a crafted search query](https://junglewise.ai/threats/cve-2024-53305-whoogle-arbitrary-code-execution-via-crafted-search-query)
- [Whoogle Search Path Traversal vulnerability](https://junglewise.ai/threats/cve-2024-22204-whoogle-search-path-traversal-vulnerability)
- [Whoogle Search Path Traversal vulnerability](https://junglewise.ai/threats/cve-2024-22203-whoogle-search-path-traversal-vulnerability)
- [Whoogle Search Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2024-22417-whoogle-search-cross-site-scripting-vulnerability)
- [Whoogle Search server-side request forgery in window endpoint](https://junglewise.ai/threats/cve-2024-22205-whoogle-search-server-side-request-forgery-in-window-endpoint)