← All advisories

Medium severity6.1NVD Advisory· Published Mar 12, 2022· Updated Jun 17, 2026

CVE-2022-26533

CVE-2022-26533

Description

Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/Xhofe/alistGo	>= 2.0.10, < 2.1.1	2.1.1

Affected products

3

ghsa-coords
pkg:golang/github.com/xhofe/alist
Range: >= 2.0.10, < 2.1.1
Alistgo/Alist
cpe:2.3:a:alistgo:alist:*:*:*:*:*:*:*:*
Range: <=2.1.0
Alist/Alistcpe-rescue

Patches

Vulnerability mechanics

References

4

github.com/Xhofe/alist/issues/645nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-jpj5-hg26-6jgcghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-26533ghsaADVISORY
github.com/Xhofe/alist/commit/6af17e2509a400979420f613fd7f2f9721fdcd6eghsaWEB

News mentions

0

No linked articles in our index yet.