CVE-2025-29512 Cross-site scripting in n/a

What is CVE-2025-29512?

CVE-2025-29512 is a medium-severity cross-site scripting vulnerability in n/a, published on 18 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP functionality unusable until content is removed via the database.

Weakness: CWE-79

Which versions are affected by CVE-2025-29512?

It affects 1 product.

Products include Nodebb Nodebb.

How do I fix CVE-2025-29512?

No fix has been published for CVE-2025-29512 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-29512 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29512 exists.

Other vulnerabilities in n/a

• CVE-2023-26045 NodeBB vulnerable to path traversal and code execution via prototype vulnerability Critical 10.0
• CVE-2020-15149 Account takeover in NodeBB Critical 9.9
• CVE-2023-43187 Code injection in n/a Critical 9.8
• CVE-2021-43786 API token verification can be bypassed Critical 9.8
• CVE-2022-46164 Account takeover via prototype vulnerability Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gpg3-h2f7-7hcx.