OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer

Description

XSS via .py file containing script tag interpreted as HTML

Recommendation

Update the @openlist-frontend/openlist-frontend package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.0.0-rc.3
• Patched version(s): 4.0.0-rc.4

References

• GHSA-2hw3-h8qx-hqqp
• CVE-2025-50183
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS) - CVE-2025-27109
• Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
• MathLive's Lack of Escaping of HTML allows for XSS - CVE-2025-29049
• JS Html Sanitizer allows XSS when used with contentEditable - CVE-2025-29771

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@openlist-frontend/openlist-frontend