Description
OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ome | omero-web | <= 5.25.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | omero-web | < 5.26.0 | 5.26.0 | GHSA-vr85-5pwx-c6gq |