GHSA-cf57-c578-7jvv

Source

https://github.com/advisories/GHSA-cf57-c578-7jvv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-cf57-c578-7jvv/GHSA-cf57-c578-7jvv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cf57-c578-7jvv

Aliases

Published

2025-10-30T17:08:12Z

Modified

2025-11-15T03:11:17Z

Severity

0.0 (None) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N CVSS Calculator
5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N CVSS Calculator

Summary

Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode

Details

Summary

When using subrequest authentication, Anubis did not perform validation of the redirect URL and redirects user to any URL scheme. While most modern browsers do not allow a redirect to javascript: URLs, it could still trigger dangerous behavior in some cases.

GET https://example.com/.within.website/?redir=javascript:alert() responds with Location: javascript:alert().

Impact

Anybody with a subrequest authentication seems affected. Using javascript: URLs will probably be blocked by most modern browsers, but using custom protocols for third-party applications might still trigger dangerous operations.

Note

This was originally reported by @mbiesiad against Weblate.

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": "2025-11-13T03:16:29Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-601",
        "CWE-79"
    ],
    "github_reviewed_at": "2025-10-30T17:08:12Z"
}

References

Affected packages

Go / github.com/TecharoHQ/anubis

Package

Name: github.com/TecharoHQ/anubis; View open source insights on deps.dev
Purl: pkg:golang/github.com/TecharoHQ/anubis

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.23.0