FKIE_CVE-2025-11687

Vulnerability from fkie_nvd - Published: 2026-01-26 20:16 - Updated: 2026-06-17 08:30
Severity
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter (reflected DOM XSS).
References
secalert@redhat.comhttps://access.redhat.com/security/cve/CVE-2025-11687
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2403536
secalert@redhat.comhttps://gitlab.gnome.org/GNOME/gi-docgen/-/issues/228
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/gi-docgen/",
          "defaultStatus": "unaffected",
          "packageName": "gi-docgen",
          "versions": [
            {
              "lessThan": "2025.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page \u2014 enabling DOM access, session cookie theft and other client-side attacks \u2014 via a crafted URL that supplies a malicious value to the q GET parameter (reflected DOM XSS)."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 un defecto en gi-docgen. Esta vulnerabilidad permite la ejecuci\u00f3n arbitraria de JavaScript en el contexto de la p\u00e1gina \u2014 permitiendo el acceso al DOM, el robo de cookies de sesi\u00f3n y otros ataques del lado del cliente \u2014 a trav\u00e9s de una URL manipulada que suministra un valor malicioso al par\u00e1metro GET q (XSS DOM reflejado)."
    }
  ],
  "id": "CVE-2025-11687",
  "lastModified": "2026-06-17T08:30:59.903",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-11687",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-26T21:01:55.875258Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-26T20:16:07.817",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2025-11687"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403536"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://gitlab.gnome.org/GNOME/gi-docgen/-/issues/228"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.