Open Redirect Affecting oarepo-vocabularies package, versions [,2.1.14)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-OAREPOVOCABULARIES-13808519
- published2 Nov 2025
- disclosed1 Nov 2025
- creditUnknown
Introduced: 1 Nov 2025
New CVE NOT AVAILABLE CWE-601 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade oarepo-vocabularies to version 2.1.14 or higher.
Overview
oarepo-vocabularies is a Support for custom fields and hierarchy on Invenio vocabularies
Affected versions of this package are vulnerable to Open Redirect.
PoC
via the create_url_rules function in the ui/resources/vocabulary_type/resource.py file. An attacker can redirect a victim user to an arbitrary malicious website by injecting a scheme-relative or absolute URL into the request path.