CVE-2025-0746 Reflected Cross-Site Scripting vulnerability in EmbedAI

Medium 6.1 Published 30 Jan 2025 Updated 18 Feb 2025

An authenticated attacker can inject malicious JavaScript via a crafted URL in EmbedAI, leading to script execution in victim browsers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-0746?

CVE-2025-0746 is a medium-severity cross-site scripting vulnerability in EmbedAI, published on 30 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to craft a malicious URL leveraging the"/embedai/users/show/<SCRIPT>" endpoint to inject the malicious JavaScript code. This JavaScript code will be executed when a user opens the malicious URL.

Weakness: CWE-79

Which versions are affected by CVE-2025-0746?

It affects 1 product.

Products include Thesamur Embedai.

How do I fix CVE-2025-0746?

No fix has been published for CVE-2025-0746 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-0746 being exploited?

There is no known exploitation of CVE-2025-0746 in the wild and no public exploit code.

Sources

Also known as GHSA-4jv8-7mvw-g797.