CVE-2021-26947: 
NixOS vulnerability analysis and mitigation

Cross-site scripting (XSS) vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web script in the browser of a victim through a crafted link. The vulnerability was assigned CVE-2021-26947 and affects both Community and Enterprise editions of the software (Odoo Issue).

The vulnerability stems from improper input validation on a generic template that allowed injection of arbitrary code which would be executed when a victim clicks on a forged link. The vulnerability received a CVSS3 Score of 6.5 (Medium) with the vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating network exploitability with no authentication required (Odoo Issue).

An attacker could potentially execute arbitrary web script code in the victim's browser when they open a specially crafted link. The vulnerability allows for unauthorized script injection, potentially leading to data theft or manipulation of the user's browser session (Odoo Issue, Debian Advisory).

The vulnerability has been patched in various versions with the following commits: 13.0: b08301e, 14.0: e451c4f, and 15.0: c3528f2. Users are strongly recommended to update to the latest revision or apply the corresponding patch. For Odoo Cloud servers, patches were applied immediately upon availability. If updating is not possible, no alternative workaround is available (Odoo Issue).