CVE-2025-65754: Algernon Cross-Site Scripting vulnerability

December 10, 2025 (updated December 18, 2025)

Cross-site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filename.

References

gist.github.com/Bnyt7/0faa90ff93c5d98093a0e29a1eb34d81
github.com/Bnyt7/CVE-2025-65754
github.com/advisories/GHSA-8jqm-8qm3-qgqm
github.com/xyproto/algernon
github.com/xyproto/algernon/commit/cd8832014a624a9aeab60566434c3344135e23f8
nvd.nist.gov/vuln/detail/CVE-2025-65754

Code Behaviors & Features

Detect and mitigate CVE-2025-65754 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →