CVE-2025-42620
Severity CVSS v4.0:
HIGH
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
08/12/2025
Last modified:
08/12/2025
Description
In affected versions, vulnerability-lookup handled user-controlled <br />
content in comments and bundles in an unsafe way, which could lead to <br />
stored Cross-Site Scripting (XSS).<br />
<br />
<br />
<br />
<br />
On the backend, the related_vulnerabilities field of bundles accepted <br />
arbitrary strings without format validation or proper sanitization. On <br />
the frontend, comment and bundle descriptions were converted from <br />
Markdown to HTML and then injected directly into the DOM using string <br />
templates and innerHTML. This combination allowed an attacker who could <br />
create or edit comments or bundles to store crafted HTML/JavaScript <br />
payloads which would later be rendered and executed in the browser of <br />
any user visiting the affected profile page (user.html). <br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
This issue affects Vulnerability-Lookup: before 2.18.0.
Impact
Base Score 4.0
8.30
Severity 4.0
HIGH