ericflo/django-avatar — Issue #28: Cross-site scripting attack vulnerability
Author: kazet
Created: 2011-12-07 19:06:44+00:00
State: open

avatar_img(avatar, size) doesnt check unicode(avatar) and the variable avatar is built according to user data. When user name is sufficiently weird, any HTML can be injected.