What is GHSA-pc5g-j9j7-p4q3?

GHSA-pc5g-j9j7-p4q3 is a security advisory published by GitHub Security Advisories with Low severity. Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

Which CVE IDs does GHSA-pc5g-j9j7-p4q3 cover?

GHSA-pc5g-j9j7-p4q3 covers the following CVE IDs: CVE-2025-65858. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-pc5g-j9j7-p4q3?

GHSA-pc5g-j9j7-p4q3 affects 1 product, including: pip/calibreweb:\u003c= 0.6.25.

GHSA-pc5g-j9j7-p4q3Low

Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

Vendor

GitHub Security Advisories

Published

December 2, 2025

Last Modified

December 2, 2025

🔗 CVE IDs covered (1)

CVE-2025-65858 →

📋 Description

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.

🎯 Affected products1

pip/calibreweb:<= 0.6.25

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-65858
https://github.com/KhanhDuy155/calibre-web-CVE-2025-65858/blob/main/CVE-2025-65858.md
https://github.com/advisories/GHSA-pc5g-j9j7-p4q3