CVE-2025-50183

{"id": "CVE-2025-50183", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-06-19T03:15:25.717", "references": [{"url": "https://github.com/OpenListTeam/OpenList-Frontend/commit/7b5ed20c608c7b9b36d1950a386678e0a89f8175", "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-2hw3-h8qx-hqqp", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in <script> tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4."}, {"lang": "es", "value": "OpenList Frontend es un componente de interfaz de usuario para OpenList. Antes de la versi\u00f3n 4.0.0-rc.4, exist\u00eda una vulnerabilidad en la funci\u00f3n de vista previa/exploraci\u00f3n de archivos de la aplicaci\u00f3n. En ciertos modos, los archivos con extensi\u00f3n .py que contienen c\u00f3digo JavaScript entre etiquetas "}], "lastModified": "2025-06-23T20:16:59.783", "sourceIdentifier": "security-advisories@github.com"}