CVE-2025-11183: 
JavaScript vulnerability analysis and mitigation

Cross-Site Scripting (XSS) vulnerability was discovered in QGIS QWC2's attribute table feature affecting versions prior to 2025.08.14. The vulnerability was initially discovered on July 23, 2025, and publicly disclosed on October 13, 2025. The vulnerability affects the QGIS Web Client (QWC2), which is a responsive web client for QGIS Server built with ReactJS and OpenLayers (Swiss Hub).

The vulnerability exists in the attribute table component where user inputs are rendered without proper encoding, enabling HTML/JS injection. The issue was specifically identified in components/LayerInfoWindow.jsx, where content was being rendered using dangerouslySetInnerHTML without proper sanitization. The vulnerability has been assigned a CVSS 4.0 score of 6.9 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/RE:L (NVD).

The vulnerability allows authorized attackers to inject arbitrary JavaScript code into the page through the attribute table's name or description fields. When other users display the affected attribute layer, the injected code executes in their browsers. This could potentially lead to website defacement or session theft of other users (Swiss Hub, Miggo).

The vulnerability requires an attacker to have edit permissions for the attributes in the attributes table. A proof of concept demonstrates that by accessing the editing dialog through the Burger Menu, drawing an arbitrary line, and injecting malicious code into the Name or Description field, an attacker can execute arbitrary JavaScript in other users' browsers (Swiss Hub).

The vulnerability has been fixed in version 2025.08.14 through patch 764fa4e5f78115d11459d9e1221cf3d39ab3b04c, which introduces sanitization using DOMPurify for untrusted input set as innerHTML. Users are recommended to update to the latest version to mitigate this vulnerability (Swiss Hub).