CVE-2025-62528: Taguette vulnerable to cross-site scripting via tag name, tag description, document name and document description

October 20, 2025 (updated June 8, 2026)

An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load.

References

github.com/advisories/GHSA-g9qw-g6rv-3889
github.com/pypa/advisory-database/tree/main/vulns/taguette/PYSEC-2025-188.yaml
github.com/remram44/taguette/security/advisories/GHSA-g9qw-g6rv-3889
gitlab.com/remram44/taguette/-/issues/330
nvd.nist.gov/vuln/detail/CVE-2025-62528

Code Behaviors & Features

Detect and mitigate CVE-2025-62528 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →