CVE-2025-11687 Gi-docgen: reflected dom xss in gi-docgen
Attackers can execute arbitrary JavaScript via a crafted URL in gi-docgen, enabling session cookie theft and DOM access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-11687?
CVE-2025-11687 is a medium-severity cross-site scripting vulnerability in gi-docgen, published on 26 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter (reflected DOM XSS).
Weakness: CWE-79
Which versions are affected by CVE-2025-11687?
3 open source packages ship an affected version, including gi-docgen.
| Package | Affected | Fixed in |
|---|---|---|
gi-docgen PyPI | All versions | 2025.5 |
gi-docgen PyPI | All versions | 2025.5 |
gi-docgen PyPI | All versions | 2025.5 |
Linux distribution packages (5)
python-gi-docgen SUSE:Linux Enterprise Server 16.0 | All versions | 2025.5-160000.1.1 |
python-gi-docgen SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2025.5-160000.1.1 |
python-gi-docgen openSUSE:Leap 16.0 | All versions | 2025.5-160000.1.1 |
gi-docgen openSUSE:Tumbleweed | All versions | 2026.1-1.1 |
python-gi-docgen openSUSE:Tumbleweed | All versions | 2025.5-1.1 |
How do I fix CVE-2025-11687?
Upgrade gi-docgen to 2025.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-11687 being exploited?
There is no known exploitation of CVE-2025-11687 in the wild and no public exploit code.
Sources
Also known as AZL-110336, DEBIAN-CVE-2025-11687, GHSA-6p6h-rqr6-62mv, MINI-87hw-qhcr-c3p2, OESA-2026-4316, OESA-2026-4317 and 8 more.