PT-2025-42806 · Taguette · Taguette

Published 2025-10-20 · Updated 2025-10-22 · CVE-2025-62528

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Taguette versions prior to 1.5.0

Description A flaw exists in Taguette that allows a project member to inject JavaScript code into the name or description fields. This code could then execute when the project is loaded. There is no information about the number of potentially affected devices worldwide or any real-world incidents where this issue was exploited.

Recommendations Upgrade to Taguette version 1.5.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62528

GHSA-G9QW-G6RV-3889

PYSEC-2025-188

Affected Products

Taguette

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62528.json · Exploit
• https://github.com/remram44/taguette/security/advisories/GHSA-g9qw-g6rv-3889 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62528 · Security Note
• https://gitlab.com/remram44/taguette/-/issues/330 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g9qw-g6rv-3889 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62528 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/taguette/PYSEC-2025-188.yaml · Note
• https://github.com/remram44/taguette · Note
• https://t.me/CVEtracker/35350 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1980383487816298555 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1odakwu/resumen_diario_de_vulnerabilidades_22102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ocduv6/resumen_diario_de_vulnerabilidades_21102025 · Reddit Post
• https://twitter.com/CVEnew/status/1980367938646643129 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ocdw3y/resumen_diario_de_vulnerabilidades_21102025 · Reddit Post