VYPR
Get started
← All advisories
Low severity3.6OSV Advisory· Published Nov 27, 2025· Updated Apr 15, 2026

CVE-2025-66040

CVE-2025-66040

Description

Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
spotipyPyPI
< 2.25.22.25.2

Affected products

1

Patches

1
880b92d7243d

Merge commit from fork

https://github.com/spotipy-dev/spotipyYue (Knox) LiuNov 26, 2025via ghsa
commit
2 files changed · +3 −1
  • CHANGELOG.md+1 −0 modified
    @@ -18,6 +18,7 @@ Add your changes below.
 
 - Fixed dead link in README.md
 - Corrected Spotify/Spotipy typo in documentation
+- Sanitize HTML error message output for OAuth flow
 
 ### Removed
  • spotipy/oauth2.py+2 −1 modified
    @@ -8,6 +8,7 @@
 ]
 
 import base64
+import html
 import logging
 import os
 import time
@@ -1252,7 +1253,7 @@ def do_GET(self):
         if self.server.auth_code:
             status = "successful"
         elif self.server.error:
-            status = f"failed ({self.server.error})"
+            status = f"failed ({html.escape(str(self.server.error))})"
         else:
             self._write("<html><body><h1>Invalid request</h1></body></html>")
             return

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.