CVE-2025-24966: Yogeshojha Rengine HTML Injection Vulnerability

CVE-2025-24966 Overview

CVE-2025-24966 is an HTML Injection vulnerability [CWE-79] in reNgine, an automated reconnaissance framework for web applications maintained by yogeshojha. The flaw resides in the Add Target functionality, where the Target Organization and Target Description fields fail to sanitize user-supplied input. Attackers with authenticated access can inject arbitrary HTML markup that renders directly in the application interface. The vulnerability affects all versions of reNgine up to and including 2.2.0.

Critical Impact
Authenticated attackers can inject arbitrary HTML into reNgine to alter page content, mislead users, and stage social engineering attacks against other operators of the platform.

Affected Products

reNgine versions up to and including 2.2.0
yogeshojha/rengine GitHub project
Deployments exposing the reNgine web interface to multiple users

Discovery Timeline

2025-02-04 - CVE-2025-24966 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24966

Vulnerability Analysis

The vulnerability stems from insufficient output encoding in reNgine's target management workflow. When a user submits a new target through the Add Target interface, the Target Organization and Target Description fields accept raw HTML without validation or sanitization. The application later renders those values in the target listing and detail views without escaping. Any HTML markup, including formatting elements, hyperlinks, iframes, and form controls, is interpreted by the browser.

Because reNgine is a reconnaissance platform used by security teams, injected content is rendered in the context of privileged operators. An attacker who registers or compromises a low-privilege reNgine account can weaponize the field to spoof interface elements, embed phishing forms, or trick administrators into visiting attacker-controlled infrastructure. HTML Injection differs from full Cross-Site Scripting because script execution depends on browser context and any residual content security policy, but it remains sufficient to defraud users.

Root Cause

The root cause is missing input sanitization and output encoding for the target_organization and description fields. The application trusts submitted values and renders them through templating without applying HTML entity encoding.

Attack Vector

Exploitation requires network access to the reNgine web interface and low-privilege credentials. The attacker submits a crafted payload through the Add Target form. Any user who subsequently views the target list executes the rendered HTML in their browser session. No user interaction beyond normal navigation is required from the victim. See the GitHub Security Advisory GHSA-4phc-m2wm-p8x6 for maintainer-provided technical detail.

Detection Methods for CVE-2025-24966

Indicators of Compromise

Target records containing HTML tags such as <iframe>, <form>, <a href>, or <img> within organization or description fields
Unexpected outbound requests from operator browsers triggered when viewing the reNgine target list
New low-privilege reNgine accounts created shortly before suspicious target entries appear

Detection Strategies

Query the reNgine database for target rows where the organization or description field contains angle-bracket characters or HTML entities
Review web server access logs for POST requests to the Add Target endpoint that carry HTML payload signatures
Instrument the reNgine frontend with Content Security Policy reporting to surface unexpected inline content and external resource loads

Monitoring Recommendations

Alert on creation of reNgine targets that include markup characters in text fields
Track authentication events and correlate new user registrations with subsequent target creation activity
Monitor operator workstations for anomalous outbound connections initiated from browser sessions active on the reNgine console

How to Mitigate CVE-2025-24966

Immediate Actions Required

Restrict reNgine web interface access to trusted networks using firewall rules or a VPN
Audit existing target records and remove entries containing HTML markup in the organization or description fields
Limit account creation to vetted operators and disable self-registration where possible
Review the vendor advisory for updates on a patched release

Patch Information

At the time of publication, no fixed version was available. The vendor advisory instructs users to monitor the reNgine project for future releases that address the issue. Track the reNgine repository and apply upgrades once a version above 2.2.0 is published with the HTML Injection fix.

Workarounds

The vendor advisory states there are no known workarounds for CVE-2025-24966
As a compensating control, deploy a reverse proxy that inspects and blocks HTML markup in reNgine form submissions
Enforce a strict Content Security Policy on the reNgine frontend to limit the impact of rendered markup

bash

# Example: nginx compensating control to block angle brackets in target field submissions
location /target/add/ {
    if ($request_method = POST) {
        if ($request_body ~* "(%3C|<)(iframe|script|form|img|a )") {
            return 403;
        }
    }
    proxy_pass http://rengine_backend;
}