OMERO.web uses jquery-form library, which may be vulnerable to XSS attack

published 2025-11-24 11mo ago modified 2025-11-24 11mo ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact OMERO.web uses the jquery-form library throughout to handle form submission and response processing. Due to some unpatched potential vulnerabilities in jquery-form, OMERO.web 5.29.2 and earlier may be susceptible to XSS attacks.

### Patches User should upgrade OMERO.web to 5.29.3 or higher.

### Workarounds None.

### Resources https://github.com/jquery-form/form/issues/604

Patch / fix

fixed in 1 links 1

pypi omero-web 5.29.3

github.com/ome/omero-web@a3eadf7 commit

Is GHSA-j4gv-6x9v-v23g in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
pypi	omero-web	<5.29.3	5.29.3

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

GitHub Advisory GHSA-j4gv-6x9v-v23g

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.