CVE-2025-30219 RabbitMQ has XSS Vulnerability in an Error Message in Management UI
Attackers can execute arbitrary JavaScript in the RabbitMQ Management UI by manipulating virtual host names, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30219?
CVE-2025-30219 is a medium-severity cross-site scripting vulnerability in rabbitmq-server, published on 25 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.
Weakness: CWE-79
Which versions are affected by CVE-2025-30219?
1 open source package ship an affected version, including rabbitmq.
| Package | Affected | Fixed in |
|---|---|---|
rabbitmq Bitnami | All versions | 4.0.3 |
Linux distribution packages (10)
rabbitmq-server SUSE:Linux Enterprise Module for Server Applications 15 SP6 | All versions | 3.8.11-150300.3.19.1 |
rabbitmq-server313 SUSE:Linux Enterprise Module for Server Applications 15 SP6 | All versions | 3.13.1-150600.13.8.1 |
rabbitmq-server SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 3.8.11-150300.3.19.1 |
rabbitmq-server313 SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 3.13.1-150600.13.8.1 |
rabbitmq-server SUSE:Linux Enterprise Server 16.0 | All versions | 4.1.5-160000.1.1 |
rabbitmq-server SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 4.1.5-160000.1.1 |
rabbitmq-server openSUSE:Leap 15.6 | All versions | 3.8.11-150300.3.19.1 |
rabbitmq-server313 openSUSE:Leap 15.6 | All versions | 3.13.1-150600.13.8.1 |
rabbitmq-server openSUSE:Leap 16.0 | All versions | 4.1.5-160000.1.1 |
rabbitmq-server openSUSE:Tumbleweed | All versions | 3.13.7-4.1 |
How do I fix CVE-2025-30219?
Upgrade rabbitmq to 4.0.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-30219 being exploited?
There is no known exploitation of CVE-2025-30219 in the wild and no public exploit code.
Sources
Also known as AZL-59276, AZL-59281, BIT-rabbitmq-2025-30219, DEBIAN-CVE-2025-30219, GHSA-g58g-82mw-9m3p, MINI-7vxj-r4gp-78v8 and 10 more.