CVE-2025-50183: OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-19 · updated 2026-06-17
Weakness: CWE-79

Description

OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in <script> tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.

Affected products

OpenListTeam OpenList: before 4.0.0-rc.4

References

https://github.com/OpenListTeam/OpenList-Frontend/commit/7b5ed20c608c7b9b36d1950a386678e0a89f8175
https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-2hw3-h8qx-hqqp

Get alerted when CVE-2025-50183 or the next vulnerability affects your stack