Skip to content
OpenAdvisories
High ALAS2023-2025-1247 1 CVE

Important: gi-docgen security update (Amazon Linux 2023)

Published Oct 27, 2025 · Updated Oct 27, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-11687: gi-docgen does not encode search terms before inserting them into HTML, allowing XSS via a crafted URL. Description obtained from: https://gitlab.gnome.org/GNOME/gi-docgen/-/issues/228

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 gi-docgen 0:2024.1-44.amzn2023
Amazon Linux · 2023 gi-docgen-doc 0:2024.1-44.amzn2023
Amazon Linux · 2023 gi-docgen-fonts 0:2024.1-44.amzn2023

Vulnerabilities 1

  • Medium 6.1
    CVE-2025-11687

    Gi-docgen: reflected dom xss in gi-docgen

    A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET p…

    gi-docgen gi-docgen gi-docgen gi-docgen Debian Ubuntu Azure Linux PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-11687.html