CVE-2025-49126: Visionatrix XSS Vulnerability

CVE-2025-49126 Overview

CVE-2025-49126 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting Visionatrix, an AI Media processing tool built on ComfyUI. The vulnerability exists in the /docs/flows endpoint, which improperly handles user-controlled input when generating Swagger documentation pages. This flaw allows attackers to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to complete application takeover and exfiltration of sensitive secrets stored within the application.

Critical Impact

This one-click attack enables full session hijacking and extraction of secrets stored in the Visionatrix application, affecting all users who click malicious links.

Affected Products

• Visionatrix versions 1.5.0 to 2.5.0 (before 2.5.1)
• Applications using FastAPI's get_swagger_ui_html function with unsanitized user input
• ComfyUI-based deployments utilizing vulnerable Visionatrix versions

Discovery Timeline

• 2025-06-23 - CVE-2025-49126 published to NVD
• 2025-06-23 - Security patch released in version 2.5.1
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-49126

Vulnerability Analysis

The vulnerability stems from improper input sanitization in the /docs/flows endpoint implementation. Visionatrix uses FastAPI's get_swagger_ui_html function to generate documentation pages. However, this function does not encode or sanitize its arguments before incorporating them into the generated HTML output. When user-controlled input is passed to this function, it creates an opportunity for attackers to inject malicious JavaScript code that executes in the victim's browser.

The attack requires minimal user interaction—simply clicking a crafted malicious link—making it highly effective for targeted attacks against Visionatrix users. Once exploited, attackers gain access to the victim's session context, enabling them to perform any action the user could perform and exfiltrate sensitive data including API keys, credentials, and processing secrets stored within the application.

Root Cause

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The get_swagger_ui_html function from FastAPI was designed for use with trusted, developer-controlled parameters and does not perform input sanitization. By passing user-controlled values to this function without proper encoding, the application allows arbitrary HTML and JavaScript injection into the generated documentation page.

Attack Vector

The attack exploits the network-accessible /docs/flows endpoint by crafting a malicious URL containing JavaScript payloads in parameters that are reflected into the Swagger UI HTML output. When a victim clicks the malicious link, the injected script executes in their browser within the application's security context. This grants the attacker access to:

• Session cookies and authentication tokens
• Stored secrets and API credentials
• Full control over the user's Visionatrix session
• Ability to perform actions on behalf of the user

The fix implements proper URL encoding using Python's urllib.parse.urlencode to sanitize input before rendering:

import shutil
from contextlib import asynccontextmanager
from pathlib import Path
+from urllib.parse import urlencode

import httpx
import uvicorn

Source: GitHub Commit

Detection Methods for CVE-2025-49126

Indicators of Compromise

• Unusual HTTP requests to /docs/flows endpoint containing URL-encoded JavaScript or HTML tags
• Server logs showing requests with <script>, javascript:, or event handler attributes (e.g., onerror, onload) in query parameters
• Client-side errors or unexpected redirects when accessing Swagger documentation pages
• Reports of users experiencing suspicious behavior after clicking links to the application's documentation

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS patterns in URL parameters targeting /docs/flows
• Deploy Content Security Policy (CSP) headers to restrict inline script execution and report policy violations
• Monitor server access logs for requests containing encoded special characters (%3C, %3E, %22) in documentation endpoint URLs
• Utilize browser-based security tools to detect DOM manipulation attempts on Swagger UI pages

Monitoring Recommendations

• Enable detailed logging for all requests to documentation endpoints (/docs/*)
• Set up alerts for high volumes of malformed requests to the Swagger documentation path
• Implement session monitoring to detect unusual activity patterns following documentation page access
• Deploy Real User Monitoring (RUM) to identify client-side JavaScript errors indicative of injection attempts

How to Mitigate CVE-2025-49126

Immediate Actions Required

• Upgrade Visionatrix to version 2.5.1 or later immediately
• Audit server logs for historical exploitation attempts targeting the /docs/flows endpoint
• Review and rotate any secrets or credentials that may have been exposed through compromised user sessions
• Notify users about the vulnerability and recommend clearing browser sessions and updating credentials

Patch Information

The vulnerability has been fixed in Visionatrix version 2.5.1. The patch implements proper URL encoding for user-controlled parameters before they are passed to FastAPI's Swagger UI generation functions. For detailed patch information, refer to the GitHub Security Advisory and the commit that addresses this issue.

Workarounds

• Restrict network access to the /docs/flows endpoint using firewall rules or reverse proxy configuration until patching is complete
• Implement strict Content Security Policy headers to prevent inline script execution: Content-Security-Policy: script-src 'self'
• Deploy a WAF rule to block requests containing potential XSS payloads in URL parameters to documentation endpoints
• Consider temporarily disabling public access to Swagger documentation pages in production environments

# Example nginx configuration to restrict access to documentation endpoints
location /docs {
    # Restrict to internal network only
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}