CVE-2024-23341: TuiTse-TsuSin XSS Vulnerability

CVE-2024-23341 Overview

CVE-2024-23341 is an HTML injection vulnerability in TuiTse-TsuSin, a Python package for organizing comparative corpora of Taiwanese Chinese characters and Roman characters. The flaw exists in the tuitse_html function, which fails to quote or sanitize input before rendering it into HTML output. An attacker who supplies crafted Taigi input can inject arbitrary HTML markup into pages generated by the package. The issue is tracked under [CWE-79] and affects versions prior to 1.3.2. The maintainers addressed the issue in version 1.3.2 via GitHub Security Advisory GHSA-m4m5-j36m-8x72.

Critical Impact
Unsanitized input passed to tuitse_html allows client-side HTML/script injection, enabling cross-site scripting against users who view generated corpus pages.

Affected Products

Ithuan TuiTse-TsuSin versions prior to 1.3.2
Python applications embedding tuitse_html for rendering Taigi corpus content
Downstream tools packaging the vulnerable ithuan:tuitse-tsusin component

Discovery Timeline

2024-01-23 - CVE-2024-23341 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23341

Vulnerability Analysis

The vulnerability resides in the tuitse_html helper inside tuitse/html.py. The function concatenates Taigi input directly into an HTML string without applying HTML entity encoding. When the resulting markup is rendered in a browser, injected tags execute in the context of the hosting page. This creates a stored or reflected cross-site scripting (XSS) condition depending on how the corpus data is delivered to users. Because the package targets educational and linguistic corpora, generated output is frequently rendered in web viewers where injected script can steal session data or perform actions on behalf of a viewer.

Root Cause

The root cause is missing output encoding on user-controlled input. Prior to 1.3.2, the function built HTML strings using raw values from the input list without escaping characters such as <, >, and ". The patch in pull request #22 restructures the rendering logic to accumulate parameters into lists that are later formatted safely, reducing exposure to raw string concatenation.

Attack Vector

Exploitation requires an attacker to control Taigi input that is later passed to tuitse_html. The attacker submits a payload containing HTML or <script> tags. When a victim opens the generated corpus page, the browser parses the injected markup and executes attacker-controlled content in that origin.

python

# Security patch in tuitse/html.py (excerpt)
 def tuitse_html(kiamtsa_tinliat):
     html = ''
-    htmlsu = ''
+    tshamsoo = []
+    su_html = ''
+    su_tshamsoo = []
     kam_ting_tsit_hing_si_lomaji = False
     kam_ting_tsit_im_si_lomaji = False
     for ji in kiamtsa_tinliat:
# Source: https://github.com/i3thuan5/TuiTse-TsuSin/commit/9d21d99d7cfcd7c42aade251fab98ec102e730ea

Detection Methods for CVE-2024-23341

Indicators of Compromise

Corpus HTML output containing unexpected <script>, <iframe>, or on*= event handler attributes
Requests submitting Taigi text fields with encoded HTML characters such as %3Cscript%3E
Browser Content Security Policy (CSP) violation reports originating from pages built with tuitse_html

Detection Strategies

Inventory Python environments and identify installations of ithuan:tuitse-tsusin older than 1.3.2 using dependency scanners such as pip-audit or SCA tools.
Review application code for direct calls to tuitse_html that receive user-controlled parameters without prior HTML escaping.
Add regression tests that submit payloads containing HTML metacharacters and assert that output is safely encoded.

Monitoring Recommendations

Enable web server and WAF logging for parameters carrying Taigi content and alert on markup metacharacters.
Deploy CSP with reporting to catch execution of injected inline scripts in corpus viewers.
Monitor package registries for the presence of vulnerable TuiTse-TsuSin versions across build pipelines.

How to Mitigate CVE-2024-23341

Immediate Actions Required

Upgrade ithuan:tuitse-tsusin to version 1.3.2 or later across all environments.
Audit application code paths that invoke tuitse_html and confirm inputs are validated at the boundary.
Rebuild and redeploy any cached corpus HTML generated by vulnerable versions.

Patch Information

The fix is delivered in TuiTse-TsuSin 1.3.2 through commit 9d21d99 and pull request #22. Details are documented in GitHub Security Advisory GHSA-m4m5-j36m-8x72.

Workarounds

Apply HTML quoting to Taigi input before passing it to tuitse_html, for example using html.escape() from the Python standard library.
Enforce a strict Content Security Policy that blocks inline scripts on pages generated by the package.
Restrict corpus submission to authenticated, trusted contributors until the upgrade is complete.

bash

# Upgrade the vulnerable package to the patched release
pip install --upgrade "tuitse-tsusin>=1.3.2"

# Verify installed version
pip show tuitse-tsusin | grep -i version