CVE-2025-10558: 3DS 3DSwymer XSS Vulnerability

CVE-2025-10558 Overview

CVE-2025-10558 is a stored Cross-Site Scripting (XSS) vulnerability in the 3DSearch component of Dassault Systèmes 3DSwymer on Release 3DEXPERIENCE R2025x. An attacker can inject arbitrary JavaScript into stored content that executes when other users view the affected page. The flaw is classified under CWE-79 and requires user interaction to trigger. Because the payload persists server-side, subsequent viewers become victims each time the malicious content renders. Successful exploitation can hijack session context, redirect users, or perform actions in the browser of an authenticated user.

Critical Impact
Stored JavaScript payloads execute in the browser sessions of legitimate 3DSwymer users, enabling session data theft, content manipulation, and cross-tenant scope changes within the 3DEXPERIENCE platform.

Affected Products

Dassault Systèmes 3DSwymer on 3DEXPERIENCE R2025x
3DSearch component within 3DSwymer
CPE: cpe:2.3:a:3ds:3dswymer:r2025x:*:*:*:*:*:*:*

Discovery Timeline

2025-10-13 - CVE-2025-10558 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10558

Vulnerability Analysis

The vulnerability resides in the 3DSearch feature of 3DSwymer, a collaborative social innovation application within the 3DEXPERIENCE platform. Attacker-controlled input is stored server-side and later rendered in another user's browser without adequate output encoding or sanitization. When a victim loads the page that includes the stored payload, the browser interprets the injected markup as executable script.

The exploitation path is network-based and requires no privileges, but does require user interaction — the victim must load or interact with the affected view. Because the payload is stored rather than reflected, a single injection can affect every user who subsequently accesses the tainted content. The scope-changed characteristic indicates the executed script can affect resources beyond the vulnerable component's security authority, such as parent frames or platform-wide session objects.

Root Cause

The root cause is improper neutralization of input during web page generation, tracked as [CWE-79]. User-supplied data flowing into 3DSearch is persisted and later rendered in an HTML context without sufficient contextual escaping. Neither input validation nor output encoding blocks HTML control characters such as <, >, and quotes, allowing attacker-supplied <script> tags or event handler attributes to execute in the DOM.

Attack Vector

An unauthenticated attacker submits crafted data to a 3DSearch-backed field that stores content processed by 3DSwymer. When a legitimate user — typically an authenticated collaborator — loads a view rendering that content, the payload executes with the user's session context. Attackers can steal session tokens accessible to JavaScript, invoke authenticated 3DEXPERIENCE API calls, deface collaborative spaces, or pivot to phishing overlays hosted in-page.

No verified proof-of-concept code is publicly available for this issue. Refer to the 3DS Security Advisory CVE-2025-10558 for vendor-supplied technical details.

Detection Methods for CVE-2025-10558

Indicators of Compromise

HTTP POST or PUT requests to 3DSwymer 3DSearch endpoints containing <script>, onerror=, onload=, or javascript: substrings in body parameters.
Server-stored search records, tags, or descriptions containing encoded HTML control characters (%3Cscript%3E, <script).
Outbound browser requests from 3DEXPERIENCE user sessions to unknown domains immediately after rendering a 3DSearch result page.

Detection Strategies

Inspect web server and application logs for parameters passed to 3DSearch containing HTML tags, event handlers, or URI schemes such as javascript: and data:.
Deploy WAF signatures that flag stored XSS payload patterns targeting 3DEXPERIENCE endpoints and correlate with successful 2xx responses.
Review Content Security Policy (CSP) violation reports for inline script executions originating from 3DSwymer pages.

Monitoring Recommendations

Enable verbose audit logging on 3DSwymer content-creation APIs and forward events to a centralized SIEM for correlation.
Alert on anomalous JavaScript-initiated requests from authenticated 3DEXPERIENCE sessions to non-corporate domains.
Track browser-side error telemetry for unexpected eval, Function, or DOM-sink executions on pages rendering 3DSearch output.

How to Mitigate CVE-2025-10558

Immediate Actions Required

Apply the security update referenced in the 3DS Security Advisory CVE-2025-10558 as prioritized by your change window.
Audit existing 3DSwymer content stores for previously injected HTML or JavaScript payloads and remove tainted records.
Invalidate active user sessions after remediation to purge any hijacked tokens.

Patch Information

Dassault Systèmes has published a security advisory for CVE-2025-10558 covering 3DSwymer on 3DEXPERIENCE R2025x. Consult the vendor advisory at 3DS Trust Center for the specific fix pack, patch identifiers, and applicable service pack levels for your deployment.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict 3DSearch content submission to authenticated, trusted roles until the patch is deployed.
Configure the HttpOnly and Secure flags on 3DEXPERIENCE session cookies to reduce token exfiltration via JavaScript.

bash

# Example CSP header to reduce stored XSS impact on 3DEXPERIENCE web tier
add_header Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  require-trusted-types-for 'script';" always;