CVE-2025-2161 Cross-site scripting in Pega Infinity
Attackers can execute arbitrary scripts in user browsers via a cross-site scripting flaw in Pega Platform Mashup features.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-2161?
CVE-2025-2161 is a high-severity cross-site scripting vulnerability in Pegasystems Pega Infinity, published on 14 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup
Weakness: CWE-79
Which versions are affected by CVE-2025-2161?
It affects 1 product.
Linux distribution packages (1)
brise openSUSE:Tumbleweed | All versions | 20230603+git.5fdd2d6-3.1 |
Products include Pega Pega Platform.
How do I fix CVE-2025-2161?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-2161 being exploited?
There is no known exploitation of CVE-2025-2161 in the wild and no public exploit code.
Other vulnerabilities in Pegasystems Pega Infinity
Sources
Also known as GHSA-j3pp-f94x-f42g, openSUSE-SU-2025:14722-1.