CVE-2025-66040

NameCVE-2025-66040
DescriptionSpotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1121540

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
spotipy (PTS)forky, sid, trixie2.25.1-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
spotipysource(unstable)(unfixed)1121540

Notes

https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-r77h-rpp9-w2xm
https://github.com/spotipy-dev/spotipy/commit/880b92d7243dcf2b83bf31dc365a858d8b5e6767 (2.25.2)

Search for package or bug name: Reporting problems