GHSA-j4gv-6x9v-v23g
OMERO.web uses jquery-form library, which may be vulnerable to XSS attack
GHSA-j4gv-6x9v-v23g is a low vulnerability (CVSS 1.3) in omero-web, published November 24, 2025. No source lists public exploit code. Fixed in omero-web 5.29.3.
- Severity
- 1.3 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.29.3omero-web +1 more
Description
Impact
OMERO.web uses the jquery-form library throughout to handle form submission and response processing. Due to some unpatched potential vulnerabilities in jquery-form, OMERO.web 5.29.2 and earlier may be susceptible to XSS attacks.
Patches
User should upgrade OMERO.web to 5.29.3 or higher.
Workarounds
None.
Resources
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
omero-webPyPI | before 5.29.3 | 5.29.3 |
omero-webPyPI | before 5.29.3, plus listed versions 5.10.05.11.05.11.0rc15.12.05.12.1 Show 45 moreShow less5.13.05.14.05.14.0rc15.14.15.15.05.16.05.17.05.18.05.19.05.20.05.21.05.22.05.22.15.23.05.23.1.dev05.24.05.25.05.26.05.27.05.27.15.27.25.28.05.29.05.29.15.29.25.5.dev15.5.dev25.6.05.6.15.6.25.6.35.6.dev15.6.dev25.6.dev35.6.dev45.6.dev55.6.dev65.6.dev75.7.05.7.15.8.05.8.15.9.05.9.15.9.2 | 5.29.3 |
What each source reports
GitHub Advisories Score used
OMERO.web uses jquery-form library, which may be vulnerable to XSS attack
Impact
OMERO.web uses the jquery-form library throughout to handle form submission and response processing. Due to some unpatched potential vulnerabilities in jquery-form, OMERO.web 5.29.2 and earlier may be susceptible to XSS attacks.
Patches
User should upgrade OMERO.web to 5.29.3 or higher.
Workarounds
None.
Resources
- Record
GHSA-j4gv-6x9v-v23g- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
OMERO.web uses jquery-form library, which may be vulnerable to XSS attack
Impact
OMERO.web uses the jquery-form library throughout to handle form submission and response processing. Due to some unpatched potential vulnerabilities in jquery-form, OMERO.web 5.29.2 and earlier may be susceptible to XSS attacks.
Patches
User should upgrade OMERO.web to 5.29.3 or higher.
Workarounds
None.
Resources
- Record
GHSA-j4gv-6x9v-v23g- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.