CVE-2025-60249: vulnerability-lookup XSS Vulnerability

CVE-2025-60249 Overview

CVE-2025-60249 is a stored Cross-Site Scripting (XSS) vulnerability in vulnerability-lookup version 2.16.0. The flaw exists in bundle.py, comment.py, and user.py, where untrusted user input is rendered in templates and tables without proper sanitization. Any authenticated user with permission to add bundles, comments, or sightings can inject arbitrary JavaScript into the application. The root cause is unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated users on a vulnerability-lookup instance can inject arbitrary JavaScript into Bundles, Comments, and Sightings components, executing in the browser context of any user viewing the affected content.

Affected Products

vulnerability-lookup 2.16.0
Bundles component (bundle.py)
Comments and Sightings components (comment.py, user.py)

Discovery Timeline

2025-09-25 - CVE-2025-60249 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60249

Vulnerability Analysis

The vulnerability arises from client-side and server-side handling of user-supplied content in three components. In bundle.py, comment.py, and user.py, dynamic content submitted by authenticated users is rendered directly into HTML templates and DOM tables. The application assigned untrusted strings to innerHTML, causing the browser to parse and execute embedded script tags and event handlers. Dynamic URLs used in rendered anchors were not encoded, permitting javascript: URIs and other injection primitives. Model fields lacked input validation, allowing script payloads to persist in stored records.

Because the payload is stored server-side and executed whenever another user views a bundle, comment, or sighting, exploitation delivers cross-user impact. Successful exploitation can lead to session token theft, unauthorized actions on behalf of victims, and manipulation of vulnerability intelligence data presented by the platform.

Root Cause

The root cause is missing output encoding and unsafe DOM APIs. The application relied on innerHTML assignments instead of safer DOM methods such as textContent, and permitted HTML attributes like rel and target on anchor tags that expanded the attack surface. URL fields were not passed through encodeURIComponent, and model-level validation did not reject or escape HTML markup before persistence.

Attack Vector

An authenticated attacker with the ability to create bundles, comments, or sightings submits a payload containing JavaScript. The malicious content is stored and later rendered without escaping. When a victim views the affected page, the injected script executes in the victim's browser session on the vulnerability-lookup origin.

python

# Patch: website/lib/constants.py - restrict allowed HTML attributes
ALLOWED_ATTRIBUTES: dict[str, list[str]] = {
-    "a": ["href", "title", "rel", "target"],
+    "a": ["href", "title"],
     "img": ["src", "alt", "title"],
}

# Patch: website/lib/sanitizers.py - centralized sanitization helpers
import html as _html
import bleach  # type: ignore[import-untyped]
from website.lib.constants import ALLOWED_ATTRIBUTES, ALLOWED_TAGS


def sanitize_html_fragment(raw_html: str) -> str:
    """Clean an HTML fragment of malicious content and return it."""
    return bleach.clean(raw_html, tags=ALLOWED_TAGS, attributes=ALLOWED_ATTRIBUTES)


def sanitize_text(raw_text: str) -> str:
    cleaned = bleach.clean(raw_text, tags=[], attributes={}, strip=True)
    return _html.escape(cleaned)

Source: GitHub commit afa1234

Detection Methods for CVE-2025-60249

Indicators of Compromise

Stored bundle, comment, or sighting records containing <script> tags, on* event handler attributes, or javascript: URI schemes.
Anchor tags in stored content with unusual href values that decode to executable JavaScript.
Outbound requests from user browsers to attacker-controlled domains immediately after loading a bundle or comment page.

Detection Strategies

Query the vulnerability-lookup database for stored fields containing HTML tags, event handlers, or protocol handlers such as javascript: and data:.
Review web server access logs for POST requests to bundle, comment, and sighting endpoints with payload bodies containing script markup.
Deploy Content Security Policy (CSP) reporting to capture inline script violations attributable to stored payloads.

Monitoring Recommendations

Monitor authenticated user activity for accounts that create unusually large numbers of bundles, comments, or sightings within a short time window.
Alert on browser console errors and CSP violation reports originating from vulnerability-lookup pages.
Track network egress from users viewing the platform for connections to previously unseen external domains.

How to Mitigate CVE-2025-60249

Immediate Actions Required

Upgrade vulnerability-lookup to a version that includes commit afa12347f1461d9481eba75ac19897e80a9c7434 or later.
Audit existing bundles, comments, and sightings for stored HTML or script payloads and purge malicious entries.
Rotate session tokens for any user who may have viewed unsanitized content since deployment of 2.16.0.

Patch Information

The fix escapes untrusted data, replaces innerHTML assignments with safer DOM methods, encodes URLs with encodeURIComponent, and improves input validation in the affected models. See the GitHub commit for vulnerability-lookup for the complete patch, which adds sanitize_html_fragment and sanitize_text helpers backed by the bleach library and restricts allowed HTML attributes.

Workarounds

Restrict bundle, comment, and sighting creation to a minimum set of trusted accounts until the patch is applied.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to the application origin.
Place a web application firewall (WAF) rule in front of the instance to block request bodies containing <script, javascript:, or common XSS event handler patterns.

bash

# Example CSP header to block inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;