Description
A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter (reflected DOM XSS).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | gi-docgen | < 2025.5 | 2025.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gi-docgen | 2025.5-1 | — |
| Debian 13 | gi-docgen | No fix yet | — |
| Debian 12 | gi-docgen | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | gi-docgen | No fix yet | — |
| Ubuntu 26.04 LTS | gi-docgen | No fix yet | — |
| Ubuntu 25.10 | gi-docgen | No fix yet | — |
| Ubuntu 24.04 LTS | gi-docgen | No fix yet | — |
| Ubuntu 22.04 LTS | gi-docgen | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-gi-docgen | 2025.5-160000.1.1 | SUSE-SU-2026:21159-1 |
| SLES 16.0 | python-gi-docgen | 2025.5-160000.1.1 | SUSE-SU-2026:21159-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gi-docgen | 2026.1-1.1 | openSUSE-SU-2026:11185-1 |
| openSUSE Tumbleweed | python-gi-docgen | 2025.5-1.1 | openSUSE-SU-2025:15634-1 |
| openSUSE Leap 16.0 | python-gi-docgen | 2025.5-160000.1.1 | openSUSE-SU-2026:20497-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | gi-docgen +2 | 2024.1-44.amzn2023 | ALAS2023-2025-1247 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | gi-docgen | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | gi-docgen | < 2025.5 | 2025.5 | GHSA-6p6h-rqr6-62mv |
Advisories 5
- openSUSE-SU-2026:11185-1 gi-docgen-2026.1-1.1 on GA media SUSE / openSUSE Security Updates · Jul 7, 2026
- openSUSE-SU-2026:20497-1 Security update for python-gi-docgen SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21159-1 Security update for python-gi-docgen SUSE / openSUSE Security Updates · Apr 22, 2026
- openSUSE-SU-2025:15634-1 python3-gi-docgen-2025.5-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- ALAS2023-2025-1247 Important: gi-docgen security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 27, 2025