OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer
Priority MEDIUM 62CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in <script> tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00316 24th percentileScored 2026-11-07
Fix Fixed OpenList (OpenListTeam): 4.0.0-rc.4@openlist-frontend/openlist-frontend (npm): 4.0.0-rc.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenListTeam | OpenList | before 4.0.0-rc.4 | 4.0.0-rc.4 | Patch available | CNA |
| — | @openlist-frontend/openlist-frontend (npm) | before 4.0.0-rc.4 | 4.0.0-rc.4 | Patch available | GHSA-2hw3-h8qx-hqqp |
- OpenList VendorOpenListTeam Affected before 4.0.0-rc.4 Fixed in 4.0.0-rc.4 Patch available CNA
- @openlist-frontend/openlist-frontend (npm) Vendor— Affected before 4.0.0-rc.4 Fixed in 4.0.0-rc.4 Patch available GHSA-2hw3-h8qx-hqqp
Remediation
- Fix · CNA OpenList (OpenListTeam) Fixed in 4.0.0-rc.4
- Fix · GHSA-2hw3-h8qx-hqqp @openlist-frontend/openlist-frontend (npm) Fixed in 4.0.0-rc.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-50183
- 2026-10-03 Alias added: GHSA-2hw3-h8qx-hqqp
References
More OpenListTeam vulnerabilities
- TI-2026-51619 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal CVSS 3.1HIGH 7.6
- TI-2026-52909 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool CVSS 3.1MEDIUM 6.5
- TI-2026-48534 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API CVSS 3.1MEDIUM 6.5
- TI-2026-71250 Path prefix check flaw in OpenList search leaks file metadata CVSS 3.1MEDIUM 4.3
Sources
- CVE-2025-50183 · CVE Program
- CVE-2025-50183 · NVD
- FIRST EPSS
- GHSA-2hw3-h8qx-hqqp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences