5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62528

CVE-2025-62528: Taguette vulnerable to cross-site scripting via tag name, tag description, document name and document description

Impact

An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load.

Patches

Users should upgrade to Taguette 1.5.0.

References

https://gitlab.com/remram44/taguette/-/issues/330

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62528

CVE-2025-62528:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
taguette	pip	< 1.5.0	1.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows for cross-site scripting (XSS) through the names and descriptions of tags and documents in Taguette. The root cause is the improper handling of user-supplied data when rendering the main project page. The analysis of the commits between the last vulnerable version (1.4.1) and the patched version (1.5.0) revealed a security fix in commit 9660f172c5f01bb4dd5c9871261bffb0d04e4704 with the message 'Escape HTML tags in embedded JSON'.

This commit modifies the taguette/web/views.py file, specifically within the Project.get method. Before the patch, this method used json.dumps to serialize project data, including potentially malicious strings, and then wrapped it with Markup to be embedded directly into the project.html template. This is unsafe as it allows for the injection of HTML tags, including <script> tags.

The patch introduces a new function, html_safe_json_dumps, which escapes the '<' character in the JSON output. This function is then used in Project.get to safely serialize the data. Therefore, the Project.get function is the vulnerable function as it is responsible for processing and rendering the malicious input. Any runtime profile during exploitation would show this function in the stack trace leading up to the rendering of the compromised page.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.4

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-62528: Taguette vulnerable to cross-site scripting via tag name, tag description, document name and document description

Impact

Patches

References

CVE-2025-62528:

5.4

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

5.4

5.4

CVE-2025-62528: Taguette vulnerable to cross-site scripting via tag name, tag description, document name and document description

Impact

Patches

References

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI