CVE-2026-32108: Python Incomplete Sanitization Or Unescaped Json

Detected potentially insufficient escaping of system inputs. First, custom sanitization using `re.sub` character classes may miss critical shell characters (like semicolons or newlines) when used to build terminal strings or HTML. Second, directly rendering `json.dumps` to variables intended for HTML can lead to Cross-Site Scripting (XSS), as `json.dumps` do

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0python
greprules fetch cve-2026-32108-python-incomplete-sanitization-or-unescaped-json --engine opengrep

Description

Detected potentially insufficient escaping of system inputs. First, custom sanitization using `re.sub` character classes may miss critical shell characters (like semicolons or newlines) when used to build terminal strings or HTML. Second, directly rendering `json.dumps` to variables intended for HTML can lead to Cross-Site Scripting (XSS), as `json.dumps` do

Detection target

Not provided

Recommended fix

Not provided

False-positive notes

Not provided

Community feedback

Sign in to report false positives, mark this rule useful, or suggest metadata improvements.