Description
A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Setting Handler. The manipulation of the argument Homepage Content/About System/Footer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| songquanpeng | one-api | 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6, 0.6.7, 0.6.8, 0.6.9, 0.6.10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250422T181640-1.1 | openSUSE-SU-2025:15017-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/songquanpeng/one-api | <= 0.6.10 | — | GHSA-wvcx-j62q-45qw |
| Go | github.com/songquanpeng/one-api | all versions | — | GO-2025-3636 |
Advisories 1
- openSUSE-SU-2025:15017-1 govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- VDB-305655 | songquanpeng one-api System Setting cross site scripting vdb-entry technical-description
- VDB-305655 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #554702 | one api latest XSS third-party-advisory
- https://github.com/yaowenxiao721/Poc/blob/main/One-API/One-API-poc.md exploit