CVE-2025-22142: NamelessMC XSS Vulnerability

CVE-2025-22142 Overview

CVE-2025-22142 is a stored Cross-Site Scripting (XSS) vulnerability in NamelessMC, a free website software widely deployed by Minecraft server communities. Administrators can configure custom fields that users fill out on their profiles. The application fails to sanitize input to these fields before rendering them in the staff panel. As a result, an attacker can inject JavaScript that executes in a staff member's browser session when a staffer views the malicious profile. The issue is fixed in version 2.1.3, and no workarounds exist.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser context of NamelessMC staff members, enabling session theft, privileged action abuse, and further compromise of the administrative panel.

Affected Products

NamelessMC Nameless versions prior to 2.1.3
Minecraft community websites running vulnerable NamelessMC deployments
Staff-panel functionality that renders user-supplied custom profile fields

Discovery Timeline

2025-01-13 - CVE-2025-22142 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22142

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under CWE-79: Improper Neutralization of Input During Web Page Generation. NamelessMC allows administrators to define custom profile fields that any registered user can populate. When a staff member navigates to a user's profile through the staff panel, the field content renders without adequate output encoding. Any JavaScript embedded in the field executes with the staffer's privileges. Because staff accounts typically hold administrative rights, an attacker can leverage the injected script to perform privileged actions, exfiltrate session tokens, or pivot deeper into the site backend.

Root Cause

The root cause is missing output sanitization when rendering user-supplied custom profile field values inside the staff panel view. Input is stored as provided and later reflected into HTML without HTML entity encoding or content security policy enforcement.

Attack Vector

Exploitation requires only a low-privileged registered user account on a NamelessMC site where the administrator has enabled custom profile fields. The attacker submits a payload containing JavaScript into the custom field on their own profile. The payload persists in the database. When any staff user opens the attacker's profile in the staff panel, the injected script executes in the staffer's authenticated browser context. See the GitHub Security Advisory GHSA-9q22-w64p-g8qm for the vendor's technical description.

Detection Methods for CVE-2025-22142

Indicators of Compromise

Custom profile field values containing HTML tags such as <script>, <img onerror=>, or <svg onload=> stored in the NamelessMC user database
Outbound HTTP requests from staff workstations to attacker-controlled domains shortly after staff visits to user profiles
Anomalous administrative actions performed from staff sessions without corresponding legitimate user activity

Detection Strategies

Query the NamelessMC database directly for stored custom field values matching common XSS patterns and event-handler attributes
Review web server access logs for staff-panel profile requests correlated with unexpected third-party script loads
Deploy a Content Security Policy in report-only mode to surface inline script violations on staff panel pages

Monitoring Recommendations

Monitor staff account activity for privilege changes, permission grants, or unusual API calls following profile views
Alert on new or modified administrator accounts created outside change-management windows
Track browser telemetry from staff endpoints for anomalous script execution while browsing internal admin URLs

How to Mitigate CVE-2025-22142

Immediate Actions Required

Upgrade NamelessMC to version 2.1.3 or later using the official v2.1.3 release
Audit all existing custom profile field values in the database and remove entries containing HTML or JavaScript syntax
Force password resets and session invalidation for all staff accounts that may have viewed unvetted profiles

Patch Information

The vendor addressed CVE-2025-22142 in NamelessMC v2.1.3. The fix applies proper output encoding to custom profile fields rendered in the staff panel. Refer to the GitHub Security Advisory GHSA-9q22-w64p-g8qm for advisory details and the v2.1.3 release notes for the code changes.

Workarounds

No official workarounds exist per the vendor advisory; upgrading to 2.1.3 is the only supported remediation
As a temporary risk-reduction measure, disable custom profile fields in the admin configuration until the patch is applied
Restrict staff-panel access to a dedicated hardened browser profile with strict Content Security Policy enforcement

bash

# Example upgrade steps for a typical NamelessMC deployment
cd /var/www/nameless
php -r "echo 'Backup DB and files before proceeding';"
wget https://github.com/NamelessMC/Nameless/releases/download/v2.1.3/Nameless-v2.1.3.zip
unzip -o Nameless-v2.1.3.zip -d /var/www/nameless
chown -R www-data:www-data /var/www/nameless
# Then run the in-app upgrade wizard via the browser