CVE-2009-2959: Cross-site scripting (XSS) vulnerability in the waterfall web status view (status/web/waterfall.py) in Buil...

Security readout for executives and security teams

This is an old Buildbot web interface XSS issue. If an organization still runs affected Buildbot versions, an attacker could cause script or HTML to run in a user’s browser through the waterfall status view. The main concern is compromise of users who view CI status pages, not direct server takeover from the CVE description. Exposure is most likely where legacy Buildbot 0.7.6 to 0.7.11p1 instances still provide the waterfall web status page to users, internal networks, or the internet. Modern Buildbot deployments outside those versions are not shown as affected by the supplied sources. Prioritize this if legacy Buildbot is still used for CI visibility, especially if the web status interface is exposed beyond trusted administrators. For organizations not running affected Buildbot versions, this should be tracked as legacy hygiene rather than an emergency. Mitigation focus: Inventory Buildbot deployments and identify any 0.7.6 through 0.7.11p1 installations.; Review Buildbot and distribution vendor advisories for the correct fixed package or upgrade path.; Restrict access to the Buildbot waterfall web status view until remediation is complete..

Prepared

Jun 28, 2026, 10:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.