PT-2025-45700 · Go · Github.Com/Techarohq/Anubis

Publicado 2025-10-30 · Atualizado 2025-10-30

OSV

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N

Summary

When using subrequest authentication, Anubis did not perform validation of the redirect URL and redirects user to any URL scheme. While most modern browsers do not allow a redirect to javascript: URLs, it could still trigger dangerous behavior in some cases.

GET https://example.com/.within.website/?redir=javascript:alert() responds with Location: javascript:alert().

Impact

Anybody with a subrequest authentication seems affected. Using javascript: URLs will probably be blocked by most modern browsers, but using custom protocols for third-party applications might still trigger dangerous operations.

Note

This was originally reported by @mbiesiad against Weblate.

Correção

XSS

Open Redirect

Enumeração de Fraquezas

CWE-79

CWE-601

Identificadores relacionados

GHSA-CF57-C578-7JVV

Produtos afetados

Github.Com/Techarohq/Anubis

Referências · 6

• https://github.com/TecharoHQ/anubis · Nota
• https://github.com/TecharoHQ/anubis/commit/7ed1753fcced351c81961bf520a7bfb2caac6e88 · Nota
• https://github.com/TecharoHQ/anubis/security/advisories/GHSA-cf57-c578-7jvv · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-64716 · Nota de Segurança
• https://pkg.go.dev/vuln/GO-2025-4086 · Nota
• https://osv.dev/vulnerability/GHSA-cf57-c578-7jvv · Aviso do Fabricante