Webrecorder pywb prior to 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.
webrecorder pywb