Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/abhinavxd/libredesk

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.3GoPublished

    Libredesk has Improper Neutralization of HTML Tags in a Web Page

    CVE-2025-68927 · GHSA-wh6m-h6f4-rjf4

    Affected
    • Go github.com/abhinavxd/libredesk < 0.8.6-beta
    Fixed in
    0.8.6-beta· Vendor fix available
    Issue
    LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in <p tags. However, by intercepting the request and removing the <p tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. --- Details When notes are added through the LibreDesk web application, the client sends note content wrapped inside <p tags. The backend appears to trust this HTML structure and stores the content as-is. By intercepting the request to: and removing the <p wrapper, an attacker can submit arbitrary HTML content. The backend does not sanitize or validate the HTML payload before persisting it. As a result: Arbitrary HTML tags (e.g., <form, <input, <img) are stored The injected HTML is rendered when the notes are viewed…

    Recommended action: Upgrade to 0.8.6-beta (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →