CVE-2025-64758: Dependency-Track Frontend XSS Vulnerability

CVE-2025-64758 Overview

CVE-2025-64758 is a stored Cross-Site Scripting (XSS) vulnerability in @dependencytrack/frontend, the Single Page Application (SPA) used by Dependency-Track. Dependency-Track is an open source Component Analysis platform that helps organizations identify risk in the software supply chain. Starting with version 4.12.0, users holding the SYSTEM_CONFIGURATION permission can configure a welcome message rendered as HTML on the login page. Versions before 4.13.6 fail to sanitize this HTML, allowing arbitrary JavaScript execution in the browser of any user visiting the login page. The flaw is tracked as CWE-79 and was fixed in version 4.13.6.

Critical Impact
An administrator-controlled welcome message executes arbitrary JavaScript in the context of every user loading the Dependency-Track login page, enabling credential theft and session hijacking.

Affected Products

Dependency-Track @dependencytrack/frontend versions 4.12.0 through 4.13.5
Dependency-Track deployments exposing the login page to multiple user accounts
Any downstream distribution bundling vulnerable frontend builds

Discovery Timeline

2025-11-17 - CVE-2025-64758 published to the National Vulnerability Database (NVD)
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-64758

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Dependency-Track administration workflow. Administrators with the SYSTEM_CONFIGURATION permission can set a welcome message intended for login-page branding. The frontend persisted the raw HTML and rendered it with Vue.js v-html, which bypasses the framework's default HTML escaping. Any user navigating to the login page then executed the stored payload within the application's origin. Because the payload runs before authentication, attackers can harvest credentials entered on the login form or redirect visitors to attacker-controlled pages.

Root Cause

The root cause is missing output sanitization in the Vue components WelcomeMessage.vue and Login.vue. Both templates bound administrator-supplied HTML directly through v-html without passing it through an HTML sanitizer. The fix in pull request #1378 integrates DOMPurify to strip executable constructs before rendering.

Attack Vector

Exploitation requires an authenticated attacker with the SYSTEM_CONFIGURATION privilege (administrator). The attacker injects an HTML payload containing JavaScript into the welcome message configuration. The payload is stored server-side and rendered on the login page for all subsequent visitors, satisfying the user-interaction requirement. Impact crosses a security boundary because unauthenticated and lower-privileged users execute the attacker's script.

text

// Patched render path in src/views/administration/configuration/WelcomeMessage.vue
             <div slot="header">
               <h4>{{ $t('admin.preview') }}</h4>
             </div>
-            <p><span v-html="welcomeMessage" /></p>
+            <p><span v-html="sanitizedWelcomeMessage" /></p>
           </b-card>
         </b-col>
       </b-row>

Source: GitHub commit 8fd757b

text

// Patched import in src/views/pages/Login.vue adds DOMPurify sanitization
 import { getRedirectUrl, getContextPath } from '../../shared/utils';
 const qs = require('querystring');
 import common from '../../shared/common';
+import DOMPurify from 'dompurify';

 export default {
   name: 'Login',

Source: GitHub commit 8fd757b

Detection Methods for CVE-2025-64758

Indicators of Compromise

Unexpected <script>, <img onerror=...>, or event-handler attributes stored in the Dependency-Track welcome message configuration.
Outbound requests from browsers loading the Dependency-Track login page to unknown third-party domains.
Audit log entries showing welcome message updates by SYSTEM_CONFIGURATION users outside of normal change windows.

Detection Strategies

Review the current welcome message value through the administration API and inspect it for HTML tags or inline JavaScript.
Diff the configuration against a known-good baseline captured before version 4.13.6 was deployed.
Correlate browser Content Security Policy (CSP) violation reports with requests to /login on Dependency-Track instances.

Monitoring Recommendations

Enable and ship Dependency-Track audit logs to a centralized logging platform and alert on configuration changes to welcome message settings.
Monitor web proxy telemetry for anomalous script loads originating from the Dependency-Track login page.
Track administrator session activity to detect unauthorized SYSTEM_CONFIGURATION role usage.

How to Mitigate CVE-2025-64758

Immediate Actions Required

Upgrade @dependencytrack/frontend to version 4.13.6 or later as soon as possible.
Audit the current welcome message content and remove any HTML that includes scripts, event handlers, or external resource references.
Rotate credentials and session tokens for any user who loaded a potentially tampered login page.

Patch Information

The issue is resolved in Dependency-Track frontend version 4.13.6. The fix, delivered in pull request #1378 and commit 8fd757b, introduces DOMPurify sanitization for the welcome message rendered on both the administration preview and the login page. Full details are documented in GitHub Security Advisory GHSA-7xvh-c266-cfr5.

Workarounds

Restrict the SYSTEM_CONFIGURATION permission to a minimal set of trusted administrators until the upgrade is applied.
Clear or set the welcome message to a plain, non-HTML string to eliminate the stored payload vector.
Deploy a strict Content Security Policy that disallows inline scripts on the Dependency-Track login page.

bash

# Verify installed Dependency-Track frontend version and upgrade via container image
docker inspect dependencytrack/frontend --format '{{.Config.Image}}'
docker pull dependencytrack/frontend:4.13.6
docker stop dependencytrack-frontend && docker rm dependencytrack-frontend
docker run -d --name dependencytrack-frontend -p 8080:8080 dependencytrack/frontend:4.13.6