GitHub Advisoryadvisory · Go

GHSA-wvcx-j62q-45qw one-api Cross-site Scripting vulnerability

MEDIUM Published 2025-04-19 Modified 2025-04-21 Official page ↗
Aliases
CVE-2025-3801
Ecosystem
Go
Packages
github.com/songquanpeng/one-api
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-04-21

Affected packages

• Go github.com/songquanpeng/one-api: <= 0.6.10 (no fix yet)

Description

A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Setting Handler. The manipulation of the argument Homepage Content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Related

Alias · CVE (1)

  • CVE-2025-3801 A vulnerability was found in songquanpeng one-api up to 0.6.10. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References