CVE-2025-62528: Taguette vulnerable to cross-site scripting via tag name, tag description, document name and document description

October 20, 2025 (updated October 21, 2025)

An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load.

References

github.com/advisories/GHSA-g9qw-g6rv-3889
github.com/remram44/taguette
github.com/remram44/taguette/security/advisories/GHSA-g9qw-g6rv-3889
gitlab.com/remram44/taguette/-/issues/330
nvd.nist.gov/vuln/detail/CVE-2025-62528

Code Behaviors & Features

Detect and mitigate CVE-2025-62528 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →