CVE-2021-39286: Webrecorder Pywb

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.

Affected products

• Webrecorder Pywb: before 2.6.0 (fixed in 2.6.0)

Published 2021-08-18. Last modified 2026-06-17.