CVE-2025-71462: Zipline before 3.7.12 XSS via url parameter on login page
Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Zipline deployments running versions before 3.7.12 are affected. Deployments on 3.7.12 or later are not identified as affected by the provided information.
What must an attacker do for exploitation to succeed?
The attacker must provide a crafted login link whose url parameter contains a javascript: URI. The victim must use that link and log in, after which the supplied JavaScript executes in the victim's browser.
How can I determine whether my instance is exposed?
Check the deployed Zipline version. An instance running a version earlier than 3.7.12 should be treated as exposed to this issue.