CVE-2025-11360

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-11360

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11360.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-11360

Published

2025-10-07T09:02:05.900Z

Modified

2026-07-08T08:07:52.225637361Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

jakowenko double-take API app.js app.use cross site scripting

Details

A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component API. The manipulation of the argument X-Ingress-Path results in cross site scripting. The attack can be executed remotely. Upgrading to version 1.13.2 is sufficient to resolve this issue. The patch is identified as e11de9dd6b4ea6b7ec9a5607a920d48961e9fa50. The affected component should be upgraded.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11360.json",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/jakowenko/double-take

Affected ranges

Type

GIT

Repo

https://github.com/jakowenko/double-take

Events

Introduced

41b7a98b905132171e92d38308bc768bb3ae63b6

Fixed

e11de9dd6b4ea6b7ec9a5607a920d48961e9fa50

Fixed

92521a0bc8ba70f64c4f794332d48387663ba20e

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.13.0"
        },
        {
            "last_affected": "1.13.0"
        },
        {
            "introduced": "1.13.1"
        },
        {
            "last_affected": "1.13.1"
        }
    ]
}

Affected versions

1.*

1.13.0

1.13.1

v1.*

v1.13.0

v1.13.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11360.json"