CVE-2024-42816: PYSEC-2026-1356 - FastAPI Admin cross-site scripting (XSS) vulnerability in the Create Product function

CVE-2024-42816 · Severity: low · CVSS 3.1 · Published 2026-07-07

FastAPI Admin is a web-based administration panel for FastAPI applications. A stored cross-site scripting (XSS) vulnerability in the product creation feature allows attackers to inject malicious scripts that are permanently stored and executed when other users view the product. An attacker could steal user session cookies, perform unauthorized actions, or redirect users to malicious sites.

Technologies: FastAPI Admin. Vendors: FastAPI Admin, PyPI.

Quick answers

Is CVE-2024-42816 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-42816 being exploited in the wild.
How severe is CVE-2024-42816?
Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?
FastAPI Admin 0.1.1 through 0.1.4; fastapi-admin (PyPI) ECOSYSTEM:introduced=0,last_affected=0.1.4.
Is there a fix for CVE-2024-42816?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-42816 attacked?
It is attacked over the network.
Am I affected by CVE-2024-42816?
Check whether you run FastAPI Admin or fastapi-admin (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored XSS vulnerability exists in the Create Product function of FastAPI Admin due to insufficient input validation and output encoding of the Product Name parameter. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). An unauthenticated attacker with access to the admin interface can inject arbitrary HTML/JavaScript payloads (e.g., `<img src=1 onerror=alert(document.cookie)>`) into the product name field; these payloads are stored in the database and executed in the browsers of all users who subsequently view the product list. The attack requires user interaction (viewing the affected page) and can impact confidentiality and integrity. The vulnerability affects fastapi-admin versions 0.1.1 through 0.1.4.

Affected products

  • FastAPI Admin fastapi-admin 0.1.1 through 0.1.4

Identifiers

  • CVE-2024-42816
  • GHSA-22xm-w7r2-834q
  • PYSEC-2026-1356

Timeline

  • 2024-08-25: disclosed: Vulnerability reported via GitHub issue
  • 2024-08-26: advisory: GHSA-22xm-w7r2-834q published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.