—

PYSEC-2026-1234

Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

Details

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/calibreweb

Introduced in: 0

No fixed version published yet for calibreweb (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-65858[ADVISORY]
https://github.com/KhanhDuy155/calibre-web-CVE-2025-65858/blob/main/CVE-2025-65858.md[WEB]
https://github.com/janeczku/calibre-web[PACKAGE]
https://pypi.org/project/calibreweb[PACKAGE]
https://github.com/advisories/GHSA-pc5g-j9j7-p4q3[ADVISORY]