6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-11687

CVE-2025-11687: GI-DocGen vulnerable to Reflected XSS via unescaped query strings

A flaw was found in GI-DocGen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter (reflected DOM XSS).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-11687

CVE-2025-11687:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gi-docgen	pip	< 2025.5	2025.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic reflected XSS caused by the improper handling of the 'q' GET parameter, which is used for the search functionality. The analysis of the patch in gidocgen/templates/basic/search.js reveals the root cause.

The original code had a function called renderResults that constructed an HTML string by directly concatenating the raw search query. The resulting string, containing the unescaped user input, was then passed to the showResults function, which used refs.search.innerHTML to inject it into the page's DOM. This is a textbook XSS vulnerability, as any HTML or JavaScript in the search query would be rendered and executed by the browser.

The patch addresses this by completely removing the vulnerable renderResults function. It introduces a new function, createResultsTitle, which safely handles the search query. Instead of building an HTML string, it creates a new <h1> DOM element and uses document.createTextNode to set its content. This ensures that the query is treated as plain text and not as HTML, effectively neutralizing the XSS vector.

The showResults function was also updated to use appendChild to add the newly created safe element to the DOM, replacing the dangerous use of innerHTML.

Therefore, the vulnerable functions are renderResults for creating the malicious payload and showResults for executing it. Both would appear in a runtime profile during exploitation of the vulnerable version.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.