GHSA-j4gv-6x9v-v23g

Suggest an improvement
Source
https://github.com/advisories/GHSA-j4gv-6x9v-v23g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-j4gv-6x9v-v23g/GHSA-j4gv-6x9v-v23g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j4gv-6x9v-v23g
Published
2025-11-24T23:35:30Z
Modified
2025-11-24T23:44:53Z
Severity
  • 1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U CVSS Calculator
Summary
OMERO.web uses jquery-form library, which may be vulnerable to XSS attack
Details

Impact

OMERO.web uses the jquery-form library throughout to handle form submission and response processing. Due to some unpatched potential vulnerabilities in jquery-form, OMERO.web 5.29.2 and earlier may be susceptible to XSS attacks.

Patches

User should upgrade OMERO.web to 5.29.3 or higher.

Workarounds

None.

Resources

https://github.com/jquery-form/form/issues/604

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-11-24T23:35:30Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}
References

Affected packages

PyPI / omero-web

Package

Name
omero-web
View open source insights on deps.dev
Purl
pkg:pypi/omero-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.29.3

Affected versions

5.*
5.5.dev1
5.5.dev2
5.6.dev1
5.6.dev2
5.6.dev3
5.6.dev4
5.6.dev5
5.6.dev6
5.6.dev7
5.6.0
5.6.1
5.6.2
5.6.3
5.7.0
5.7.1
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
5.10.0
5.11.0rc1
5.11.0
5.12.0
5.12.1
5.13.0
5.14.0rc1
5.14.0
5.14.1
5.15.0
5.16.0
5.17.0
5.18.0
5.19.0
5.20.0
5.21.0
5.22.0
5.22.1
5.23.0
5.23.1.dev0
5.24.0
5.25.0
5.26.0
5.27.0
5.27.1
5.27.2
5.28.0
5.29.0
5.29.1
5.29.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-j4gv-6x9v-v23g/GHSA-j4gv-6x9v-v23g.json"