medium5.1
CVE-2025-65754
Algernon Cross-Site Scripting vulnerability
Impact
Cross-site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filename.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/xyproto/algernon | < 1.17.5 | 1.17.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Algernon Project | Algernon | Version 1.17.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/Bnyt7/0faa90ff93c5d98093a0e29a1eb34d81
- https://github.com/Bnyt7/CVE-2025-65754
- https://github.com/xyproto/algernon
- https://github.com/advisories/GHSA-8jqm-8qm3-qgqm
- https://nvd.nist.gov/vuln/detail/CVE-2025-65754
- https://github.com/xyproto/algernon/commit/cd8832014a624a9aeab60566434c3344135e23f8