Executive brief
OpenList-Frontend is a web-based interface for managing and browsing files. A security flaw in its file preview feature allows malicious code hidden inside Python (.py) files to be executed in a user's browser when they view the file. If exploited, an attacker could steal sensitive information such as login cookies or session data from users who view the malicious file.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the file preview and browsing component of OpenList-Frontend. The root cause is the application's failure to properly sanitize or restrict the rendering of non-HTML files; specifically, files with a .py extension containing <script> tags may be interpreted as HTML by the browser in certain modes (notably when using ISO-8859-1 encoding). An attacker can exploit this by uploading or tricking a user into viewing a malicious .py file. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's session, potentially leading to the theft of cookies, localStorage data, and other sensitive session information. The issue is fixed in version 4.0.0-rc.4 by ensuring file extensions are correctly handled during rendering.
Affected products
- OpenListTeam OpenList-Frontend <= 4.0.0-rc.3
Timeline
- 2025-06-17: disclosed: Vulnerability reported and confirmed by maintainers.
- 2025-06-17: patched: Fix committed to the repository.
- 2025-06-18: advisory: GitHub Security Advisory published.