Executive brief
WebOb is a Python library used by web applications to handle HTTP requests and responses. A security flaw in how it handles web address redirects allows attackers to trick users into visiting malicious external websites. By providing a specially crafted link, an attacker can bypass security filters and redirect a user from a trusted site to an attacker-controlled one, potentially leading to phishing or malware delivery.
Technical details
WebOb prior to 1.8.10 is vulnerable to an open redirect (CWE-601) during HTTP Location header normalization. The library uses Python's 'urljoin' to merge redirect targets with the request URI. Since Python 3.10, 'urlsplit' (used internally by urljoin) strips ASCII tab, carriage return, and newline characters before parsing. An attacker can supply a redirect target containing these characters (e.g., '/\t/attacker.com') which, after stripping, is interpreted as a protocol-relative URL ('//attacker.com'). This bypasses the previous fix for CVE-2024-42353. Exploitation requires the attacker to influence the redirect location and for a user to interact with the crafted link. The issue is fixed in version 1.8.10.
Affected products
- Pylons Project WebOb < 1.8.10
Timeline
- 2026-06-02: advisory: GitHub advisory published by maintainers
- 2026-06-22: disclosed: NVD publication date
- 2026-06-22: patched: Version 1.8.10 released