PT-2025-45700 · Go · Github.Com/Techarohq/Anubis

Published 2025-10-30 · Updated 2025-10-30

OSV

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N

Summary

When using subrequest authentication, Anubis did not perform validation of the redirect URL and redirects user to any URL scheme. While most modern browsers do not allow a redirect to javascript: URLs, it could still trigger dangerous behavior in some cases.

GET https://example.com/.within.website/?redir=javascript:alert() responds with Location: javascript:alert().

Impact

Anybody with a subrequest authentication seems affected. Using javascript: URLs will probably be blocked by most modern browsers, but using custom protocols for third-party applications might still trigger dangerous operations.

Note

This was originally reported by @mbiesiad against Weblate.

Fix

XSS

Open Redirect

Weakness Enumeration

CWE-79

CWE-601

Related Identifiers

GHSA-CF57-C578-7JVV

Affected Products

Github.Com/Techarohq/Anubis

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-64716 · Security Note
• https://osv.dev/vulnerability/GHSA-cf57-c578-7jvv · Vendor Advisory
• https://github.com/TecharoHQ/anubis · Note
• https://github.com/TecharoHQ/anubis/commit/7ed1753fcced351c81961bf520a7bfb2caac6e88 · Note
• https://github.com/TecharoHQ/anubis/security/advisories/GHSA-cf57-c578-7jvv · Note
• https://pkg.go.dev/vuln/GO-2025-4086 · Note