GitHub Advisoryadvisory · Go

GHSA-8jqm-8qm3-qgqm Algernon Cross-Site Scripting vulnerability

MEDIUM Published 2025-12-10 Modified 2025-12-18 Official page ↗

Aliases: CVE-2025-65754
Ecosystem: Go
Packages: github.com/xyproto/algernon
Severity: Moderate
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses: CWE-79
Reviewed: 2025-12-10

Affected packages

• Go github.com/xyproto/algernon: < 1.17.5 → fixed in 1.17.5

Description

Cross-site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filename.

Related

Alias · CVE (1)

CVE-2025-65754 Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a… vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References