{"action":"Upgrade copyparty to 1.18.5 or later.","affected":[{"fixed":"1.18.5","introduced":"0"}],"component":"copyparty","cve_ids":["CVE-2025-54423"],"ecosystem":"PyPI","epss":0.00472,"exploited":false,"fixed_versions":["1.18.5"],"ghsa_id":"GHSA-9q4r-x2hj-jmvr","id":"tcs_01M5KGRMERJ5PE51E9MVTFKXWT","modified_at":"2026-07-07T17:47:21.115497296Z","published_at":"2026-07-07T16:02:59.039311Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1277","https://github.com/9001/copyparty/security/advisories/GHSA-9q4r-x2hj-jmvr","https://nvd.nist.gov/vuln/detail/CVE-2025-54423","https://github.com/9001/copyparty/commit/895880aeb0be0813ddf732487596633f8f9fc3a6","https://github.com/9001/copyparty","https://github.com/9001/copyparty/releases/tag/v1.18.5","https://pypi.org/project/copyparty","https://github.com/advisories/GHSA-9q4r-x2hj-jmvr"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-1277","url":"https://osv.dev/vulnerability/PYSEC-2026-1277"}],"summary":"copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata"}