~ / search / GHSA-6p6h-rqr6-62mv

GHSA-6p6h-rqr6-62mv

GI-DocGen vulnerable to Reflected XSS via unescaped query strings

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-11687

Packages

EcosystemPackageAffectedFixed in
PyPI gi-docgen < 2025.5 2025.5

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in GI-DocGen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter (reflected DOM XSS).

References

External links from the advisory. They lead to third-party sites.