Description
Cross-site scripting (XSS) vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab ("%09") character, which prevents the rest of the query from being properly sanitized.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | namazu2 | 2.0.14-1 | — |
| Debian 12 | namazu2 | 2.0.14-1 | — |
| Debian 3.0 | namazu2 | 2.0.10-1woody3 | DSA-627-1 |
Advisories 1
- DSA-627-1 namazu2 - unsanitised input Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1012805 vdb-entry
- 1012802 vdb-entry
- DSA-627 vendor-advisory
- 13600 third-party-advisory
- namazu-tab-query-xss(18623) vdb-entry
- http://www.namazu.org/security.html.en#xss-tab
- 12053 vdb-entry
- SUSE-SR:2005:001 vendor-advisory
- FEDORA-2004-557 vendor-advisory
- http://jvn.jp/jp/JVN%23904429FE.html
- 12516 vdb-entry
- HPSBMA01212 vendor-advisory