Medium, CVSS 6.5npmAmendedPublished
OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer
CVE-2025-50183 · GHSA-2hw3-h8qx-hqqp
- Affected
- npm @openlist-frontend/openlist-frontend <= 4.0.0-rc.3
- Fixed in
- 4.0.0-rc.4· Vendor fix available
- Issue
- XSS via .py file containing script tag interpreted as HTML Summary A vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in <script tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. Affected Versions <= 4.0.0-rc.3 PoC Create a .py file with arbitrary JavaScript content wrapped in <script tags. For example: When a victim views the file in browsing mode (e.g., a rendered preview), the JavaScript is executed in the browser context. --- Attack vector An attacker can place such a .py file in the system via remote channels, such as: Convincing a webmaster to download or upload the file; Tricking users into accessing a file link via public URLs. Required permissions None, if public or visitor access is enabled. If the file is uploaded by a user with elevated permissions, potential privilege boundaries may be crossed. User interaction Yes. The…
Recommended action: Upgrade to 4.0.0-rc.4 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.