CVE-2025-66040

{
  "id": "CVE-2025-66040",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-27T00:15:55.343",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2."
    },
    {
      "lang": "es",
      "value": "Spotipy es una biblioteca de Python para la API web de Spotify. Versiones anteriores a la versión 2.25.2, existe una vulnerabilidad de cross-site scripting (XSS) en el servidor de callback de OAuth que permite la inyección de JavaScript a través del parámetro de error no saneado. Los atacantes pueden ejecutar JavaScript arbitrario en el navegador del usuario durante la autenticación de OAuth. Este problema ha sido parcheado en la versión 2.25.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "spotipy-dev",
          "product": "spotipy",
          "versions": [
            {
              "version": "< 2.25.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 3.6,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-28T15:25:12.176179Z",
          "id": "CVE-2025-66040",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/spotipy-dev/spotipy/commit/880b92d7243dcf2b83bf31dc365a858d8b5e6767",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-r77h-rpp9-w2xm",
      "source": "[email protected]"
    }
  ]
}