CVE-2025-11437: JhumanJ OpnForm XSS Vulnerability

CVE-2025-11437 Overview

CVE-2025-11437 is a cross-site scripting (XSS) vulnerability affecting JhumanJ OpnForm versions up to and including 1.9.3. The flaw resides in an unspecified portion of the /api/open/forms/ endpoint within the Form Editor component. An authenticated attacker can inject script content that executes in the context of users who interact with the affected form. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Public exploit details have been released, though the vendor states the affected feature is disabled until a user configures a custom domain, which limits the attack surface.

Critical Impact
Authenticated users can inject malicious script payloads through the Form Editor that may execute in victims' browsers when they view affected forms.

Affected Products

JhumanJ OpnForm versions up to and including 1.9.3
Component: Form Editor (/api/open/forms/ endpoint)
Deployments where custom domains have been configured by the user

Discovery Timeline

2025-10-08 - CVE-2025-11437 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-11437

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input processed through the OpnForm Form Editor. Content submitted via the /api/open/forms/ endpoint is not adequately sanitized or encoded before being rendered. This allows an attacker with elevated privileges to embed HTML or JavaScript payloads inside form definitions. When a legitimate user later renders the form, the injected script executes in the browser session under the application's origin. The attack is remote and requires user interaction to trigger payload execution.

Root Cause

The root cause is a missing or insufficient output-encoding routine within the Form Editor data path. Form configuration input accepted by the API endpoint is persisted and later reflected to end users without context-aware escaping. This design oversight permits script content stored in form definitions to be interpreted as executable markup by the browser.

Attack Vector

Exploitation requires an authenticated account with permission to create or modify forms. The attacker crafts a form containing an XSS payload and submits it through the /api/open/forms/ interface. Victims who open the form in a browser trigger the stored payload. The vendor notes the vulnerable surface is disabled by default and only activated once a user configures a custom domain, limiting exposure to specific deployment configurations.

No verified exploit code is publicly available for inclusion here. See the VulDB Entry #327374 for additional technical context.

Detection Methods for CVE-2025-11437

Indicators of Compromise

Form definitions stored in OpnForm containing <script> tags, javascript: URIs, or inline event handlers such as onerror= and onload=
Unexpected outbound requests from end-user browsers to attacker-controlled domains after rendering an OpnForm form
HTTP POST or PUT requests to /api/open/forms/ carrying HTML entities or encoded script payloads in form fields

Detection Strategies

Inspect stored form records in the OpnForm database for script tags, event handler attributes, or obfuscated JavaScript
Review web server access logs for suspicious payloads submitted to the /api/open/forms/ endpoint
Deploy a web application firewall (WAF) rule set that identifies XSS payload signatures in requests to the Form Editor API

Monitoring Recommendations

Alert on OpnForm administrative API calls originating from unusual IP addresses or user accounts
Monitor browser Content Security Policy (CSP) violation reports for blocked inline script execution on form rendering pages
Track changes to form definitions and correlate authoring activity with session metadata for anomaly detection

How to Mitigate CVE-2025-11437

Immediate Actions Required

Audit all existing OpnForm instances running version 1.9.3 or earlier for malicious payloads in stored form definitions
Restrict Form Editor privileges to trusted administrative accounts and enforce strong authentication
Avoid configuring a custom domain on OpnForm instances until a vendor patch is applied, since the vendor identifies this as the trigger for the vulnerable feature

Patch Information

At the time of the last NVD update on 2026-06-17, the issue was listed as under review for additional handling. Monitor the JhumanJ OpnForm project for release notes addressing CVE-2025-11437 and apply any security update as soon as it becomes available.

Workarounds

Do not configure a custom domain on OpnForm until a security update is released, per the vendor advisory
Enforce a strict Content Security Policy that disallows inline script execution on pages rendering OpnForm content
Limit creation and modification of forms to vetted internal users to reduce the risk of stored script injection

bash

# Example Content Security Policy header to limit XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'