## possible javascript insertion via insufficient htmlscrubbing of alternate stylesheets
-Tango noticed that 'meta stylesheet` directives allowed anyone
+Giuseppe Bilotta noticed that 'meta stylesheet` directives allowed anyone
who could upload a malicious stylesheet to a site to add it to a
-page as an alternate stylesheet. In order to be exploited, the user
-would have to select the alternative stylesheet in their browser.
+page as an alternate stylesheet, or replacing the default stylesheet.
This hole was discovered on 28 Mar 2011 and fixed the same hour with
the release of ikiwiki 3.20110328. An upgrade is recommended for sites
that have untrusted committers, or have the attachments plugin enabled.
+([[!cve CVE-2011-1401]])