CVE-2025-30203: Enalean Tuleap RSS Widget XSS Vulnerability

CVE-2025-30203 Overview

CVE-2025-30203 is a stored cross-site scripting (XSS) vulnerability in Tuleap, an open source suite for software development management and team collaboration. The flaw resides in the handling of RSS feed content rendered by the RSS widget. A project administrator, or an attacker who controls an RSS feed consumed by a Tuleap project, can inject script content that executes in the browsers of users viewing the widget. The issue is tracked under CWE-79 and is fixed in Tuleap Community Edition 16.5.99.1742562878, Tuleap Enterprise Edition 16.5-5, and Tuleap Enterprise Edition 16.4-8.

Critical Impact

Attackers with control over a subscribed RSS feed can execute arbitrary JavaScript in the context of authenticated Tuleap users, enabling session abuse and cross-project impact.

Affected Products

• Enalean Tuleap Community Edition prior to 16.5.99.1742562878
• Enalean Tuleap Enterprise Edition prior to 16.5-5
• Enalean Tuleap Enterprise Edition prior to 16.4-8

Discovery Timeline

• 2025-03-31 - CVE-2025-30203 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30203

Vulnerability Analysis

Tuleap allows project administrators to add RSS widgets that fetch and render external feeds inside project dashboards. The widget renders feed content without properly sanitizing HTML and script constructs sourced from the feed body. When the feed contains attacker-controlled markup, the payload is stored and served to any Tuleap user who loads the widget. Because Tuleap dashboards are viewed by developers, project members, and administrators, the payload runs with the privileges of every viewer session.

The scope change reflected in the vulnerability metrics indicates that a payload rendered in the RSS widget can affect resources outside the vulnerable component, such as other Tuleap dashboards or session tokens accessible in the same origin.

Root Cause

The root cause is missing output encoding of RSS feed content prior to insertion into the DOM by the RSS widget renderer. Untrusted HTML from <title>, <description>, and related feed elements is passed to the page without stripping active content. The fix commit 54cce3f5e883d16055cb0239e023f48cdf5eb25f addresses the sanitization gap in the widget rendering path.

Attack Vector

Exploitation requires two preconditions. First, an actor must control an RSS feed URL configured in a Tuleap RSS widget, either as a project administrator adding a malicious feed or as an operator of a legitimate feed subsequently repurposed. Second, a victim user must load the dashboard containing the widget. Upon load, the injected script executes in the browser with the victim's Tuleap session context, enabling actions such as issuing authenticated requests, exfiltrating tokens accessible to the page, or pivoting to other project resources.

No verified exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-39gx-34fc-rx6r for the vendor description.

Detection Methods for CVE-2025-30203

Indicators of Compromise

• RSS widget configurations pointing to unexpected or newly added external feed URLs on project dashboards.
• Outbound requests from user browsers to attacker-controlled domains immediately after loading a Tuleap dashboard containing an RSS widget.
• Feed responses containing <script> tags, inline event handlers (onerror, onload), or javascript: URIs within <title> or <description> elements.

Detection Strategies

• Inspect Tuleap application logs and database entries for RSS widget definitions and correlate feed URLs against an allowlist of approved sources.
• Deploy Content Security Policy (CSP) reporting to capture blocked inline script executions triggered by RSS content.
• Review web proxy logs for anomalous JavaScript-driven requests originating from Tuleap dashboard sessions.

Monitoring Recommendations

• Alert on additions or modifications to RSS widget configurations by project administrators.
• Monitor for Tuleap version banners still reporting pre-patch releases across Community and Enterprise deployments.
• Track feed hosts for content changes that introduce HTML or script constructs where prior payloads contained only text.

How to Mitigate CVE-2025-30203

Immediate Actions Required

• Upgrade Tuleap Community Edition to 16.5.99.1742562878 or later.
• Upgrade Tuleap Enterprise Edition to 16.5-5 or 16.4-8 depending on the release track in use.
• Audit existing RSS widgets and remove feeds sourced from untrusted or unverified providers.
• Rotate session cookies and API tokens for users known to have viewed dashboards with suspicious RSS widgets.

Patch Information

The fix is delivered in commit 54cce3f5e883d16055cb0239e023f48cdf5eb25f. See the GitHub Commit Record and the Tuleap Tracker Details for verification. Full advisory context is available in the GitHub Security Advisory GHSA-39gx-34fc-rx6r.

Workarounds

• Restrict the project administrator role to trusted personnel to limit who can add or modify RSS widgets.
• Remove RSS widgets from dashboards where an immediate upgrade is not feasible.
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to the Tuleap origin.

# Example CSP header to reduce XSS impact until patched
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";