Then I must have misread your report, it read like "0.9.1 and 0.9.2 are vulnerable, please upgrade to 0.9.3" -- Trac 0.9.1 and 0.9.2 to fix SQL injection vulnerabilities, 0.9.3 – XSS vulnerabilities https://launchpad.net/bugs/5297