Read the docs
TI-2024-23254 Aliases CVE-2024-35180GHSA-vr85-5pwx-c6gq

OMERO.web JSONP callback vulnerability

Priority LOW 27CWE-830Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Fix Fixed omero-web (PyPI): 5.26.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
omeomero-webup to 5.25.0—No fix listedCNA
—omero-web (PyPI)before 5.26.05.26.0Patch availableGHSA-vr85-5pwx-c6gq
  • omero-web Vendorome Affected up to 5.25.0 Fixed in — No fix listed CNA
  • omero-web (PyPI) Vendor— Affected before 5.26.0 Fixed in 5.26.0 Patch available GHSA-vr85-5pwx-c6gq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openmicroscopy:omero-web:*:*:*:*:*:*:*:*before 5.26.0Vulnerableome
  • cpe:2.3:a:openmicroscopy:omero-web:*:*:*:*:*:*:*:* Versions before 5.26.0 Vulnerable ·ome

Remediation

  • Fix · GHSA-vr85-5pwx-c6gq omero-web (PyPI) Fixed in 5.26.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-35180
  2. 2026-10-03 Alias added: GHSA-vr85-5pwx-c6gq

References

Patch 1

Advisory 2

Other 1

  • TI-2021-17971 Inconsistent input sanitisation leads to XSS vectors CVSS 3.1CRITICAL 9.8
  • TI-2025-34546 OMERO.web displays unecessary user information when requesting to reset the password CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences