spotipy -- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

2025-12-06 · CVE-2025-66040 · VuXML entry

https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-r77h-rpp9-w2xm reports: Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. …

Affected versions

• py310-spotipy, py311-spotipy, py312-spotipy, py313-spotipy, py313t-spotipy, py314-spotipy < 2.25.2

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.