Cross-Site Scripting Vulnerability in Zipline by Diced
CVE-2025-71462

5.1MEDIUM

Key Information:

Vendor

Diced

Status
Zipline
Vendor
CVE Published:
13 November 2026

What is CVE-2025-71462?

Zipline versions prior to 3.7.12 are affected by a cross-site scripting vulnerability in the login page. This vulnerability allows attackers to craft a specially formatted login link that includes a malicious 'javascript:' URI in the url parameter. When users attempt to log in, the JavaScript code can be executed in the browser, leading to potential security risks such as session hijacking or data theft. Users of affected versions should update to the latest revision to mitigate this security issue.

Affected Version(s)

zipline 0 < 3.7.12

zipline 3.7.12

References

https://github.com/diced/zipline/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/zipline-before-3.7.1...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.