AIKIDO-2026-274638
pagy is vulnerable to HTML Injection
31
Low Risk
This Affects:
pagyTL;DR
pagy builds pagination link href attributes by interpolating a composed query string directly into HTML without HTML-escaping it. Because the & separators between query parameters are emitted raw, an HTML parser can decode a following parameter name that begins with a legacy named character reference as an HTML entity. Reflected untrusted request parameters can therefore change the parsed link URL and the parameters a victim sends when following a pagination link. The fix HTML-escapes the composed URL with CGI.escapeHTML before placing it in the href attribute.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application reflects untrusted request parameters into pagy pagination links.
Background info
pagy is vulnerable to HTML Injection in versions 1.0.0 - 43.6.0.
How to fix this
Upgrade the pagy library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant