Python's Official Docs Contain Textbook XSS Vulnerability

Security researcher Georgi Guninski discovered a critical cross-site scripting (XSS) vulnerability in a code example within the Python 3.12 official documentation's CGI module. The vulnerability stems from directly outputting user-supplied form data without any sanitization. This poses a significant risk to Python web development and potentially impacts AI-generated code like that from ChatGPT and Deepseek. While the CGI module is removed in Python 3.13, a substantial amount of legacy code remains vulnerable.