CVE-2025-61190: Lyrasis Dspace JSPUI XSS Vulnerability

CVE-2025-61190 Overview

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover filtering functionality. The vulnerability exists due to improper sanitization of user-supplied input via the filter_type_1 parameter. This flaw allows attackers to inject malicious scripts that execute in the context of a victim's browser session when they click on a specially crafted link.

Critical Impact

Attackers can exploit this vulnerability to steal session cookies, redirect users to malicious websites, deface repository pages, or perform actions on behalf of authenticated users within the DSpace digital repository system.

Affected Products

• Lyrasis DSpace version 6.5
• DSpace JSPUI (JavaServer Pages User Interface) component
• Search/Discover filtering functionality

Discovery Timeline

• 2026-03-27 - CVE-2025-61190 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2025-61190

Vulnerability Analysis

This Reflected XSS vulnerability (CWE-79) affects the DSpace JSPUI interface, specifically within the search and discovery filtering mechanism. The root issue stems from the application's failure to properly sanitize or encode user-supplied input before reflecting it back in the HTTP response.

When a user submits a search query or applies filters through the JSPUI interface, the filter_type_1 parameter value is included in the page response without adequate escaping. This allows an attacker to craft a malicious URL containing JavaScript code that will execute when the victim visits the link.

The attack requires user interaction—specifically, the victim must click on a malicious link crafted by the attacker. Once clicked, the injected script executes within the security context of the DSpace application, potentially allowing the attacker to access sensitive data or perform unauthorized actions.

Root Cause

The vulnerability originates from improper input validation and output encoding in the DSpace JSPUI search/discover module. The filter_type_1 parameter is processed and reflected in the response without being sanitized through appropriate HTML encoding functions. This violates the principle of treating all user input as untrusted and failing to apply context-appropriate output encoding before rendering content in the browser.

Attack Vector

The attack vector is network-based, requiring no authentication from the attacker. The exploitation path follows these steps:

1. The attacker identifies the vulnerable filter_type_1 parameter in the search/discover filtering functionality
2. A malicious URL is crafted containing JavaScript payload in the parameter value
3. The attacker delivers this URL to potential victims via phishing emails, social media, or compromised websites
4. When a victim clicks the link, the DSpace server reflects the malicious input in the response
5. The victim's browser executes the injected script in the context of the DSpace session

The vulnerability is documented in a GitHub Gist code example that demonstrates the exploitation technique. Additional resources are available at the DSpace Resource Hub and Lyrasis Security Insights.

Detection Methods for CVE-2025-61190

Indicators of Compromise

• Suspicious URL patterns containing JavaScript code or HTML tags in the filter_type_1 parameter
• Web server logs showing requests with encoded <script> tags, event handlers (e.g., onerror, onload), or javascript: protocol in filter parameters
• Unusual redirect attempts or external resource loading originating from DSpace pages
• User reports of unexpected browser behavior after clicking links to the DSpace repository

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in URL parameters
• Deploy SentinelOne Singularity XDR to monitor for malicious script execution patterns and browser-based attacks
• Review web server access logs for patterns matching XSS exploitation attempts targeting the filter_type_1 parameter
• Enable Content Security Policy (CSP) violation reporting to identify potential XSS exploitation attempts

Monitoring Recommendations

• Configure real-time alerting for HTTP requests containing common XSS patterns such as <script>, javascript:, or encoded variants
• Monitor for unusual outbound connections from client browsers that may indicate successful script injection
• Track authentication anomalies that could indicate session hijacking following XSS exploitation
• Implement user behavior analytics to detect account takeover resulting from credential theft via XSS

How to Mitigate CVE-2025-61190

Immediate Actions Required

• Upgrade DSpace to the latest available version that includes security patches for this vulnerability
• Implement input validation to reject or sanitize special characters in the filter_type_1 parameter
• Deploy a Web Application Firewall (WAF) with XSS protection rules as a defense-in-depth measure
• Apply Content Security Policy headers to restrict inline script execution

Patch Information

Organizations running DSpace JSPUI version 6.5 should check the Lyrasis Security Insights and DSpace Resource Hub for official security advisories and patch releases. Upgrading to the latest supported version is the recommended remediation approach.

Workarounds

• Disable or restrict access to the JSPUI search/discover filtering functionality until a patch can be applied
• Implement server-side input validation to strip or encode HTML special characters from the filter_type_1 parameter
• Deploy a reverse proxy or WAF rule to sanitize requests before they reach the DSpace application
• Consider switching to the DSpace Angular UI (if available) which may not be affected by this specific vulnerability

# Example Apache configuration for basic XSS protection header
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
</IfModule>