{"id":"CVE-2025-50183","aliases":["EUVD-2025-18905","GHSA-2hw3-h8qx-hqqp"],"status":"published","title":"OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer","description":"OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in \u003cscript\u003e tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00316,"percentile":0.24771,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-06-18T14:41:25Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"npm","package":"@openlist-frontend/openlist-frontend","fixed_in":["4.0.0-rc.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@openlist-frontend/openlist-frontend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.0-rc.3"},{"fixed":"4.0.0-rc.4"}]}]},{"source":"osv","ecosystem":"npm","package":"@openlist-frontend/openlist-frontend","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.0.0-rc.4"}]}]}],"products":[{"vendor":"openlistteam","product":"openlist"}],"references":[{"url":"https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-2hw3-h8qx-hqqp","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/OpenListTeam/OpenList-Frontend/commit/7b5ed20c608c7b9b36d1950a386678e0a89f8175","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50183","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2hw3-h8qx-hqqp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50183.json","tags":["advisory"]},{"url":"https://github.com/OpenListTeam/OpenList","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-50183","title":"OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer","description":"OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in \u003cscript\u003e tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.","status":"published","published":"2025-06-19T02:20:32.618Z","modified":"2025-06-23T16:57:37.085Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:52.526476Z"}],"euvd":[{"id":"EUVD-2025-18905","description":"OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in \u003cscript\u003e tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.","status":"published","published":"2025-06-19T02:20:32Z","modified":"2025-06-23T16:57:37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:17.832534Z"}],"ghsa":[{"id":"GHSA-2hw3-h8qx-hqqp","title":"OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer","description":"XSS via `.py` file containing script tag interpreted as HTML\n\n## Summary\n\nA vulnerability exists in the file preview/browsing feature of the application, where files with a `.py` extension that contain JavaScript code wrapped in `\u003cscript\u003e` tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability.\n\n## Affected Versions\n\n* \u003c= 4.0.0-rc.3\n\n## PoC\n\nCreate a `.py` file with arbitrary JavaScript content wrapped in `\u003cscript\u003e` tags. For example:\n\n```javascript\n\u003cscript\u003ealert(document.cookie);\u003c/script\u003e\n```\n\nWhen a victim views the file in browsing mode (e.g., a rendered preview), the JavaScript is executed in the browser context.\n\n--- \n\n## Attack vector\n\nAn attacker can place such a `.py` file in the system via remote channels, such as:\n* Convincing a webmaster to download or upload the file; \n* Tricking users into accessing a file link via public URLs.\n\n## Required permissions\n\n* None, if public or visitor access is enabled.\n* If the file is uploaded by a user with elevated permissions, potential privilege boundaries may be crossed.\n\n## User interaction\n\nYes. The user must manually click to switch to the browsing or preview mode to trigger the script. And seems only when using `ISO-8859-1` encoding.\n\n## Scope\n\n* Unchanged `(S:U)` - The attack does not cross system or privilege boundaries in general.\n* ⚠️ Controversial edge case: If sensitive preview files are accessible due to misconfiguration, scope could be considered Changed `(S:C)`.\n\n## Impact\n\n* Confidentiality: User information including cookies, login state, and localStorage may be accessed. Some files that only can be viewed via this user will leak too.\n* Integrity \u0026 Availability: Not directly impacted.\n\n---\n\n## Recommendations\n\n* Treat all previewed file types (including non-HTML like .py) as plain text unless explicitly sanitized.\n* Disable rendering modes that can interpret user-uploaded content as HTML.\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| 2025-06-17 | Vulnerability reported |\n| 2025-06-17 | Comminuty Manager confirmed |\n| 2025-06-17 | Fixed |\n\n# Credits\n\n* Discovered by: @zyk2507\n* Reported to: [The OpenList Team](https://github.com/OpenListTeam)\n* Analyzed and confirmed by: @jyxjjj\n* Fixed by: @cxw620\n* Fixed in: `4.0.0-rc.4`","status":"published","published":"2025-06-18T14:41:25Z","modified":"2025-06-19T15:19:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:47.835488Z"}],"nvd":[{"id":"CVE-2025-50183","description":"OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in \u003cscript\u003e tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.","status":"published","published":"2025-06-19T03:15:25.717Z","modified":"2026-06-17T09:34:49.07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:13.247441Z"}],"osv":[{"id":"CVE-2025-50183","title":"OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer","description":"OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in \u003cscript\u003e tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.","status":"published","published":"2025-06-19T02:20:32.618Z","modified":"2026-10-28T02:30:42.162726914Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-2hw3-h8qx-hqqp","title":"OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer","description":"XSS via `.py` file containing script tag interpreted as HTML\n\n## Summary\n\nA vulnerability exists in the file preview/browsing feature of the application, where files with a `.py` extension that contain JavaScript code wrapped in `\u003cscript\u003e` tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability.\n\n## Affected Versions\n\n* \u003c= 4.0.0-rc.3\n\n## PoC\n\nCreate a `.py` file with arbitrary JavaScript content wrapped in `\u003cscript\u003e` tags. For example:\n\n```javascript\n\u003cscript\u003ealert(document.cookie);\u003c/script\u003e\n```\n\nWhen a victim views the file in browsing mode (e.g., a rendered preview), the JavaScript is executed in the browser context.\n\n--- \n\n## Attack vector\n\nAn attacker can place such a `.py` file in the system via remote channels, such as:\n* Convincing a webmaster to download or upload the file; \n* Tricking users into accessing a file link via public URLs.\n\n## Required permissions\n\n* None, if public or visitor access is enabled.\n* If the file is uploaded by a user with elevated permissions, potential privilege boundaries may be crossed.\n\n## User interaction\n\nYes. The user must manually click to switch to the browsing or preview mode to trigger the script. And seems only when using `ISO-8859-1` encoding.\n\n## Scope\n\n* Unchanged `(S:U)` - The attack does not cross system or privilege boundaries in general.\n* ⚠️ Controversial edge case: If sensitive preview files are accessible due to misconfiguration, scope could be considered Changed `(S:C)`.\n\n## Impact\n\n* Confidentiality: User information including cookies, login state, and localStorage may be accessed. Some files that only can be viewed via this user will leak too.\n* Integrity \u0026 Availability: Not directly impacted.\n\n---\n\n## Recommendations\n\n* Treat all previewed file types (including non-HTML like .py) as plain text unless explicitly sanitized.\n* Disable rendering modes that can interpret user-uploaded content as HTML.\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| 2025-06-17 | Vulnerability reported |\n| 2025-06-17 | Comminuty Manager confirmed |\n| 2025-06-17 | Fixed |\n\n# Credits\n\n* Discovered by: @zyk2507\n* Reported to: [The OpenList Team](https://github.com/OpenListTeam)\n* Analyzed and confirmed by: @jyxjjj\n* Fixed by: @cxw620\n* Fixed in: `4.0.0-rc.4`","status":"published","published":"2025-06-18T14:41:25Z","modified":"2025-06-19T15:19:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:34.338541Z"}]}}