web.py EUVD-2026-84551

Exploitation requires the target to be running a web.py 0.76 application that uses the Jinja template renderer (render_jinja) and reflects user-controlled input into rendered output without adequate output encoding - the flaw is anchored in render_jinja's initialization, implying template escaping behavior is the relevant setting. Exploitation is LIMITED by mandatory victim interaction (UI:R: the user must open an attacker-crafted link or submit attacker-influenced input) and by the fact that impact is confined to the victim's browser session within the site origin (no server-side read/write or availability loss). Realistic risk therefore depends on whether the deployed application actually passes untrusted data into Jinja-rendered responses.

This is a textbook reflected Cross-Site Scripting (CWE-79) issue in the web.py Python framework (version 0.76) tied to the render_jinja.__init__() code path. The signals are internally consistent and point to a genuine-but-moderate concern rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) indicates remote, low-complexity, unauthenticated reach, but the mandatory UI:R (user interaction) and the limited, browser-context-only Confidentiality/Integrity impacts cap the severity at Medium - no availability impact. EPSS strongly agrees it is not a mass-exploitation target: 0.19% probability at the 9th percentile, i.e., very low near-term exploitation likelihood. There is NO CISA KEV listing and no vendor-confirmed active exploitation. A third-party technical writeup exists (lichoin/TraceLoom) which may contain reproduction detail, but no weaponized, self-contained public exploit is confirmed from the input. Net: a legitimate client-side vulnerability worth patching in web.py 0.76 deployments, but low real-world urgency - not a high-CVSS-but-illusory issue, and equally not a drop-everything priority. Note that render_jinja.__init__() suggests the defect sits in how the Jinja renderer is initialized (e.g., autoescape handling), so impact depends on how the application passes user-controlled data into rendered templates - verify with the application's template usage.

An attacker crafts a URL or input that, when processed by a web.py 0.76 application using the Jinja renderer, reflects unescaped attacker-controlled markup into an HTTP response. The attacker lures a victim into clicking the link (UI:R), causing their browser to execute attacker-supplied JavaScript in the site's origin, enabling session/cookie theft or UI redress. A third-party technical writeup describing the flaw exists, but no fully weaponized public exploit is confirmed.