CVE catalog

CVE-2025-11687

gi-docgen: CVE-2025-11687

Severity: Medium · CVSS 5.8CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Published: Oct 13, 2025, 11:25:02 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.38% · Oct 25, 2026

A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET parameter (reflected DOM XSS).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gi-docgen	sid	`2026.1-2`	fixed
Debian	gi-docgen	forky	`2026.1-2`	fixed
Debian	gi-docgen	trixie	`2025.3-1`	vulnerable
Debian	gi-docgen	bookworm	`2023.1+ds-2`	vulnerable
Opensuse	gi-docgen	tumbleweed	`2026.1-1.1`	fixed
Opensuse	python-gi-docgen	leap 16.0	`2025.5-160000.1.1`	fixed
Suse	python-gi-docgen	linux enterprise server 16.0	`2025.5-160000.1.1`	fixed
Suse	python-gi-docgen	linux enterprise server for sap applications 16.0	`2025.5-160000.1.1`	fixed
Opensuse	python-gi-docgen	tumbleweed	`2025.5-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gi-docgen	source	sid	`2025.5-1`	not yet assigned	Not reported	[1118145]
Debian	gi-docgen	source	forky	`2025.5-1`	not yet assigned	Not reported	[1118145]
Debian	gi-docgen	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1118145]
Debian	gi-docgen	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1118145]
Opensuse	gi-docgen	rpm	tumbleweed	`2026.1-1.1`	Not reported	OPENSUSE-SU-2026:11185-1	Not reported
Opensuse	python-gi-docgen	rpm	leap 16.0	`2025.5-160000.1.1`	Not reported	OPENSUSE-SU-2026:20497-1	Not reported
Suse	python-gi-docgen	rpm	linux enterprise server 16.0	`2025.5-160000.1.1`	Not reported	SUSE-SU-2026:21159-1	Not reported
Suse	python-gi-docgen	rpm	linux enterprise server for sap applications 16.0	`2025.5-160000.1.1`	Not reported	SUSE-SU-2026:21159-1	Not reported
Opensuse	python-gi-docgen	rpm	tumbleweed	`2025.5-1.1`	Not reported	OPENSUSE-SU-2025:15634-1	Not reported

[Debian bug #1118145]

Notes

[trixie] gi-docgen: Minor issue [bookworm] gi-docgen: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gi-docgen]Affected
Details (2)
- 2023.1+ds-2 · all · bookworm
  Affected
  dsa · gi-docgen · debian · bookworm; dsa · gi-docgen · debian · 12
- 2023.1+ds-2 · all · bookworm
  Affected
  dsa · gi-docgen · debian · bookworm; dsa · gi-docgen · debian · 12
[gi-docgen-doc]Affected
Source package: [gi-docgen]
Details (2)
- 2023.1+ds-2 · all · bookworm
  Affected
  dsa · gi-docgen · debian · bookworm; dsa · gi-docgen · debian · 12
- 2023.1+ds-2 · all · bookworm
  Affected
  dsa · gi-docgen · debian · bookworm; dsa · gi-docgen · debian · 12

[Debian 13 (Trixie)]

[gi-docgen]Affected
Details (2)
- 2025.3-1 · all · trixie
  Affected
  dsa · gi-docgen · debian · 13
- 2025.3-1 · all · trixie
  Affected
  dsa · gi-docgen · debian · 13
[gi-docgen-doc]Affected
Source package: [gi-docgen]
Details (2)
- 2025.3-1 · all · trixie
  Affected
  dsa · gi-docgen · debian · 13
- 2025.3-1 · all · trixie
  Affected
  dsa · gi-docgen · debian · 13

[openSUSE Tumbleweed]

[gi-docgen]Fixed
Source package: [gi-docgen]
Details (1)
- 2026.1-1.1 · noarch · tumbleweed
  Fixed · Fixed: 2026.1-1.1
  dsa · gi-docgen · opensuse · tumbleweed

Observed: Oct 24, 2026, 5:21:23 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]