GHSA-75mw-h36v-2jv7: Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers

June 26, 2026

The HTML and RSS output handlers in dosagelib/events.py write user-controlled content (comic text and page URLs) directly into generated files without proper HTML escaping. When a user scrapes a malicious webcomic and opens the generated HTML/RSS file, attacker-controlled JavaScript can execute in their browser.

CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)

References

github.com/advisories/GHSA-75mw-h36v-2jv7
github.com/webcomics/dosage/security/advisories/GHSA-75mw-h36v-2jv7

Code Behaviors & Features

Detect and mitigate GHSA-75mw-h36v-2jv7 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →