CVE-2025-11687
CVE-2025-11687 · Gi-docgen: reflected dom xss in gi-docgen
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter (reflected DOM XSS).
CVSS 6.1 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
gi-docgen Debian:12
- Versions
- 2023.1+ds-2
- 2023.1+ds-3
- 2023.1+ds-4
- 2023.1+ds-5
- 2023.3+ds-1
- 2024.1+ds-1
- 2024.1+ds-2
- 2025.3-1
- 2025.4-1
- 2025.5-1
- 2026.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gi-docgen Debian:13
- Versions
- 2025.3-1
- 2025.4-1
- 2025.5-1
- 2026.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gi-docgen Debian:14
- Versions
- 2025.3-1
- 2025.4-1
- Affected ranges
- ECOSYSTEM: < 2025.5-1
Update to 2025.5-1
gi-docgen PyPI
- Versions
- 2021.1
- 2021.2
- 2021.3
- 2021.4
- 2021.5
- 2021.6
- 2021.7
- 2021.8
- 2022.1
- 2022.2
- 2023.1
- 2023.2
- 2023.3
- 2024.1
- 2025.3
- 2025.4
- Affected ranges
- ECOSYSTEM: < 2025.5
Update to 2025.5
gi-docgen Ubuntu:22.04:LTS
- Versions
- 2021.8+ds1-2
- 2022.1+ds-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gi-docgen Ubuntu:24.04:LTS
- Versions
- 2023.1+ds-3
- 2023.1+ds-4
- 2023.1+ds-5
- 2023.3+ds-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gi-docgen Ubuntu:25.10
- Versions
- 2025.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gi-docgen Ubuntu:26.10
- Versions
- 2026.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gi-docgen Ubuntu:26.04:LTS
- Versions
- 2025.3-1
- 2025.5-1
- 2026.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published