CVE-2025-61190: Lyrasis DSpace JSPUI XSS Vulnerability

CVE-2025-61190 Overview

CVE-2025-61190 is a Reflected Cross-Site Scripting (XSS) vulnerability in DSpace JSPUI 6.5, an open-source repository platform maintained by Lyrasis. The flaw resides in the search/discover filtering functionality and stems from improper sanitization of the filter_type_1 parameter. Attackers can craft malicious URLs that, when visited by an authenticated or unauthenticated user, execute arbitrary JavaScript in the victim's browser session. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions within the DSpace repository under the victim's privileges.

Affected Products

Lyrasis DSpace JSPUI 6.5
DSpace deployments using the JSPUI interface
Repository instances exposing search/discover to untrusted users

Discovery Timeline

2026-03-27 - CVE-2025-61190 published to NVD
2026-03-31 - Last updated in NVD database

Technical Details for CVE-2025-61190

Vulnerability Analysis

The vulnerability exists in the DSpace JSPUI 6.5 search and discovery filtering component. The filter_type_1 query parameter accepts user-supplied input that is reflected back into the rendered HTML response without proper output encoding or sanitization. This allows an attacker to inject arbitrary HTML and JavaScript that executes in the context of the DSpace application origin.

Because DSpace serves academic and institutional repositories, the application often holds privileged sessions for librarians, administrators, and content submitters. The CVSS vector indicates user interaction is required, with scope change reflecting the impact of script execution on browser-controlled resources. Reflected XSS in this context can target administrative users via crafted phishing links.

Root Cause

The root cause is missing output encoding when the filter_type_1 parameter value is echoed into the search results page. The JSPUI servlet does not apply context-appropriate escaping (HTML entity encoding, attribute encoding, or JavaScript string encoding) before rendering user input into the response. As a result, payloads such as <script> tags or event handler attributes are interpreted by the browser as executable markup.

Attack Vector

An attacker crafts a URL targeting the DSpace search/discover endpoint with a malicious payload in the filter_type_1 parameter. The attacker delivers the link through email, chat, or a third-party website. When a victim clicks the link, the server reflects the payload into the response, and the victim's browser executes the injected JavaScript under the DSpace domain. The script can read cookies, exfiltrate session tokens, submit forms on behalf of the user, or redirect to credential harvesting pages.

A proof-of-concept payload structure is published in the GitHub Gist Example Code referenced in the advisory.

Detection Methods for CVE-2025-61190

Indicators of Compromise

Web server access logs containing requests to /search/discover with filter_type_1 values that include <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Outbound requests from user browsers to attacker-controlled domains immediately after visiting DSpace search URLs.
Anomalous session activity from administrator accounts originating from unexpected geolocations following click-through on external links.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters on search/discover endpoints for XSS signatures and reflected payloads.
Implement Content Security Policy (CSP) reporting endpoints to capture inline script execution attempts and policy violations.
Correlate HTTP referer and parameter contents in SIEM platforms to identify reflection patterns characteristic of XSS probes.

Monitoring Recommendations

Enable verbose logging of query strings on Tomcat or front-end proxies serving DSpace JSPUI.
Alert on user-agent and session anomalies for accounts with content management or administrative roles.
Monitor email and collaboration platforms for inbound links targeting the institutional DSpace hostname with encoded payload patterns.

How to Mitigate CVE-2025-61190

Immediate Actions Required

Apply input validation and output encoding patches from the DSpace project for the JSPUI search/discover handler.
Deploy WAF rules to block requests containing script tags or JavaScript event handlers in the filter_type_1 parameter.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.

Patch Information

No vendor advisory URL is listed in the NVD entry at publication. Administrators should consult the DSpace project and Lyrasis for upgrade guidance and migrate to a supported DSpace release that addresses the JSPUI XSS issue. DSpace 6.x reached end of community support, and migration to DSpace 7 or later is recommended.

Workarounds

Disable or restrict access to the JSPUI interface where the XSS reflection occurs, and route users to the alternative XMLUI or DSpace 7 UI if available.
Add server-side input filtering at a reverse proxy to strip or reject HTML metacharacters in the filter_type_1 parameter.
Set HttpOnly and Secure flags on session cookies to reduce the impact of script-based cookie theft.

bash

# Example NGINX rule to block reflected XSS payloads on the search endpoint
location /jspui/search/discover {
    if ($args ~* "filter_type_1=.*(<|%3C)(script|svg|img|iframe)") {
        return 403;
    }
    proxy_pass http://dspace_backend;
}