OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in <script> tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.

Affected: npm: @openlist-frontend/openlist-frontend

XSS via `.py` file containing script tag interpreted as HTML

## Summary

A vulnerability exists in the file preview/browsing feature of the application, where files with a `.py` extension that contain JavaScript code wrapped in `<script>` tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability.

## Affected Versions

* <= 4.0.0-rc.3

## PoC

Create a `.py` file with arbitrary JavaScript content wrapped in `<script>` tags. For example:

```javascript <script>alert(document.cookie);</script> ```

When a victim views the file in browsing mode (e.g., a rendered preview), the JavaScript is executed in the browser context.

---

## Attack vector

An attacker can place such a `.py` file in the system via remote channels, such as: * Convincing a webmaster to download or upload the file; * Tricking users into accessing a file link via public URLs.

## Required permissions

* None, if public or visitor access is enabled. * If the file is uploaded by a user with elevated permissions, potential privilege boundaries may be crossed.

## User interaction

Yes. The user must manually click to switch to the browsing or preview mode to trigger the script. And seems only when using `ISO-8859-1` encoding.

## Scope

* Unchanged `(S:U)` - The attack does not cross system or privilege boundaries in general. * ⚠️ Controversial edge case: If sensitive preview files are accessible due to misconfiguration, scope could be considered Changed `(S:C)`.…