CVE-2025-42620
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
08/12/2025
Última modificación:
08/12/2025
Descripción
*** Pendiente de traducción *** In affected versions, vulnerability-lookup handled user-controlled <br />
content in comments and bundles in an unsafe way, which could lead to <br />
stored Cross-Site Scripting (XSS).<br />
<br />
<br />
<br />
<br />
On the backend, the related_vulnerabilities field of bundles accepted <br />
arbitrary strings without format validation or proper sanitization. On <br />
the frontend, comment and bundle descriptions were converted from <br />
Markdown to HTML and then injected directly into the DOM using string <br />
templates and innerHTML. This combination allowed an attacker who could <br />
create or edit comments or bundles to store crafted HTML/JavaScript <br />
payloads which would later be rendered and executed in the browser of <br />
any user visiting the affected profile page (user.html). <br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
This issue affects Vulnerability-Lookup: before 2.18.0.
Impacto
Puntuación base 4.0
8.30
Gravedad 4.0
ALTA