CVE-2025-30342 Cross-site scripting in OpenSlides

Medium 5.4 Published 21 Mar 2025 Updated 21 Mar 2025

Attackers can inject JavaScript via link attributes in OpenSlides, executing code in victim sessions to potentially take over accounts.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-30342?

CVE-2025-30342 is a medium-severity cross-site scripting vulnerability in Intevation OpenSlides, published on 21 Mar 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly encoded when reflected; however, adding attributes to links is possible, which allows the injection of JavaScript via the onmouseover attribute and others. When a user moves the mouse over such a prepared link, JavaScript is executed in that user's session.

Weakness: CWE-79

Which versions are affected by CVE-2025-30342?

It affects 1 product.

Products include Openslides Openslides.

How do I fix CVE-2025-30342?

No fix has been published for CVE-2025-30342 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-30342 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-30342 exists.

Sources

Also known as GHSA-6h9q-x65f-g9gv.