GHSA-j4gv-6x9v-v23g OMERO.web uses jquery-form library, which may be vulnerable to XSS attack
OMERO.web is vulnerable to XSS attacks via the jquery-form library, allowing attackers to execute scripts in user browsers.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-j4gv-6x9v-v23g?
GHSA-j4gv-6x9v-v23g is a cross-site scripting vulnerability in omero-web, published on 24 Nov 2025. It can be exploited over the network, and only if a user opens a file or follows a link.
Official description
Impact
OMERO.web uses the jquery-form library throughout to handle form submission and response processing. Due to some unpatched potential vulnerabilities in jquery-form, OMERO.web 5.29.2 and earlier may be susceptible to XSS attacks.
Patches
User should upgrade OMERO.web to 5.29.3 or higher.
Workarounds
None.
Resources
Which versions are affected by GHSA-j4gv-6x9v-v23g?
2 open source packages ship an affected version, including omero-web.
| Package | Affected | Fixed in |
|---|---|---|
omero-web PyPI | All versions | 5.29.3 |
omero-web PyPI | All versions | 5.29.3 |
How do I fix GHSA-j4gv-6x9v-v23g?
Upgrade omero-web to 5.29.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-j4gv-6x9v-v23g being exploited?
There is no known exploitation of GHSA-j4gv-6x9v-v23g in the wild and no public exploit code.