CVE-2025-62528: Taguette cross-site scripting vulnerability via tag name, tag description, document name and document description

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-20 · updated 2026-10-08
Weakness: CWE-79

Description

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0.

Affected products

remram44 taguette: before 1.5.0 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: remram44 taguette 1.5.0. Check the vendor advisory for mitigations.

References

https://github.com/remram44/taguette/security/advisories/GHSA-g9qw-g6rv-3889
https://gitlab.com/remram44/taguette/-/issues/330

Get alerted when CVE-2025-62528 or the next vulnerability affects your stack