---
id: "CVE-2025-11183"
page: "https://infrastack.ai/live/CVE-2025-11183"
kind: "vulnerability"
aliases: ["CVE-2025-11183", "GHSA-gxp8-m5rq-3m38"]
title: "QGIS QWC2 Cross-Site Scripting vulnerability"
severity: "medium"
cvss: 6.9
epss: 0.0042
exploited: false
status: "open"
category: "package"
products: [{"name": "qwc2", "fixed": ["2025.8.14"], "affected": "< 2025.8.14", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-79", "npm", "package", "qgis", "qwc2", "web-gis"]
not_affected_if: ["fixed-version"]
published_at: "2025-10-13T10:15:45+00:00"
first_seen_at: "2026-11-05T21:08:59+00:00"
updated_at: "2026-11-05T21:10:30+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-gxp8-m5rq-3m38", "first_seen_at": "2026-11-05T21:08:59+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11183", "first_seen_at": "2026-11-05T21:10:30+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.0042, "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-11183"}]
---

# QGIS QWC2 Cross-Site Scripting vulnerability

Link for people: https://infrastack.ai/live/CVE-2025-11183 (this .md is for agents)

QWC2, a web client for QGIS map servers, has a cross-site scripting flaw in its attribute table. An authorized user can plant arbitrary JavaScript that runs in other users' browsers.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:qwc2 affected < 2025.8.14 fixed 2025.8.14

## How to check

- Check the installed version of the `qwc2` npm package, for example with `npm ls qwc2`.
- Look at the `qwc2` entry in `package.json` and `package-lock.json` for a version below `2025.8.14`.

## Fix

- `qwc2` `2025.8.14`

## Timeline

- 2026-11-05T21:08:59+00:00 ghsa https://github.com/advisories/GHSA-gxp8-m5rq-3m38
- 2026-11-05T21:10:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-11183

## From the sources

Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 < 2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_