---
id: CVE-2024-35180
aliases:
  - GHSA-vr85-5pwx-c6gq
  - PYSEC-2026-1718
title: OMERO.web must check that the JSONP callback is a valid function
summary: OMERO.web must check that the JSONP callback is a valid function
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: omero-web
product: omero-web
ecosystem: pip
affected:
  - omero-web < 5.26.0
patched:
  - omero-web 5.26.0
published: '2024-05-21'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:14.386489880Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vr85-5pwx-c6gq'
references:
  - url: 'https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-35180'
  - url: >-
      https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa
  - url: 'https://github.com/ome/omero-web'
tags:
  - osv
  - pip
epss: 0.00291
epssPercentile: 0.1928
ingestedAt: '2026-07-08T18:25:53.376Z'
---

## Overview

### Background

There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. One such endpoint is `/webclient/imgData/...`. As we only really use these endpoints with jQuery's own callback name generation [^1] it is quite difficult or even impossible to exploit this in vanilla OMERO.web. However, these metadata endpoints are likely to be used by many plugins.

[^1]: https://learn.jquery.com/ajax/working-with-jsonp/

### Impact
OMERO.web before 5.25.0

### Patches
Users should upgrade to 5.26.0 or higher
### Workarounds

None

### References
* https://stackoverflow.com/questions/2777021/do-i-need-to-sanitize-the-callback-parameter-from-a-jsonp-call
* https://stackoverflow.com/questions/1661197/what-characters-are-valid-for-javascript-variable-names

For more information
If you have any questions or comments about this advisory:

Open an issue in [omero-web](https://github.com/ome/omero-web)
Email us at [security@openmicroscopy.org](mailto:security@openmicroscopy.org)


## Affected packages

- `omero-web < 5.26.0`

## Remediation

Upgrade to a patched release:

- `omero-web 5.26.0`