CVE-2025-42620 CSRF vulnerability in CIRCL Vulnerability-Lookup
Stored XSS in Vulnerability-Lookup allows attackers to execute scripts in victims' browsers via unsafe comment and bundle handling.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-42620?
CVE-2025-42620 is a high-severity cross-site scripting vulnerability in CIRCL Vulnerability-Lookup, published on 8 Dec 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way, which could lead to stored Cross-Site Scripting (XSS).
On the backend, the related_vulnerabilities field of bundles accepted arbitrary strings without format validation or proper sanitization. On the frontend, comment and bundle descriptions were converted from Markdown to HTML and then injected directly into the DOM using string templates and innerHTML. This combination allowed an attacker who could create or edit comments or bundles to store crafted HTML/JavaScript payloads which would later be rendered and executed in the browser of any user visiting the affected profile page (user.html).
This issue affects Vulnerability-Lookup: before 2.18.0.
Weakness: CWE-79
Which versions are affected by CVE-2025-42620?
How do I fix CVE-2025-42620?
No fix has been published for CVE-2025-42620 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-42620 being exploited?
There is no known exploitation of CVE-2025-42620 in the wild and no public exploit code.
Sources
Also known as GHSA-r226-j7pf-48g6.