Threats affecting pkg:github/janeczku/Calibre-Web

CVE-2025-65858 is a stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 that allows attackers with user creation privileges to inject malicious JavaScript into the username field. This payload is stored unsanitized and executed when the /ajax/listusers endpoint is accessed, potentially leading to limited confidentiality and integrity impacts. The vulnerability requires authenticated access and user interaction to trigger. Although the CVSS score is low (3.5), the flaw could be leveraged in targeted attacks within environments using Calibre-Web. No known exploits are currently reported in the wild, and no patches have been published yet. European organizations using Calibre-Web should be aware of this vulnerability and implement mitigations to prevent exploitation. Countries with higher adoption of Calibre-Web or with strategic interest in digital libraries and document management may be more affected.

In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization.