{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-66629 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2025-66629 yet. Limit exposure of the affected software until one is available.","what":"CVE-2025-66629 is a low-severity vulnerability in hedgedoc, published on 5 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2025-66629 and fix it if it is affected.\n\nWhat it is: CVE-2025-66629 is a low-severity vulnerability in hedgedoc, published on 5 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2025-66629 in the wild and no public exploit code.\n\nAffected product: hedgedoc. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-66629/ (Markdown: https://insights.sbomify.com/CVE-2025-66629/index.md)","id":"CVE-2025-66629","markdown":"https://insights.sbomify.com/CVE-2025-66629/index.md","name":"CVE-2025-66629","record":{"aliases":["GHSA-6wm6-3vpq-6qvv"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"HedgeDoc notes application","requires_auth":"low_privilege","summary":"Attackers can perform CSRF attacks on HedgeDoc OAuth2 login flows due to missing state parameter validation, potentially leading to account takeover.","user_interaction":"required","vuln_class":"csrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"hedgedoc","vendor":"hedgedoc"}],"cvss":{"score":3.7,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"description":"HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response using this parameter. This vulnerability is fixed in 1.10.4.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF","id":"CVE-2025-66629","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"csrf","year":"2025"},"n_packages":0,"n_references":2,"next":{"headline":"Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure","id":"CVE-2025-66630"},"packages":[],"prev":{"headline":"ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)","id":"CVE-2025-66628"},"products":["hedgedoc"],"published":"2025-12-05","related":[{"cvss_score":10,"headline":"PDF export allows arbitrary file reads","id":"CVE-2021-29475","kev_date_added":null,"published":"2021-04-26"},{"cvss_score":8.7,"headline":"Stored XSS in mermaid diagrams","id":"CVE-2020-26287","kev_date_added":null,"published":"2020-12-28"},{"cvss_score":8.1,"headline":"XSS vector in slide mode speaker-view","id":"CVE-2021-39175","kev_date_added":null,"published":"2021-08-30"},{"cvss_score":8.1,"headline":"Improper Neutralization of Script-Related HTML Tags in Notes","id":"CVE-2021-29503","kev_date_added":null,"published":"2021-05-19"},{"cvss_score":7.5,"headline":"Arbitary file upload","id":"CVE-2020-26286","kev_date_added":null,"published":"2020-12-28"},{"cvss_score":7.4,"headline":"Stored XSS in slide mode","id":"CVE-2021-21259","kev_date_added":null,"published":"2021-01-22"},{"cvss_score":6.5,"headline":"MySQL \u0026 free URL mode allows to hide existing notes in hedgedoc","id":"CVE-2024-45308","kev_date_added":null,"published":"2024-09-02"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-12-08","vendors":["hedgedoc"]},"summary":"Attackers can perform CSRF attacks on HedgeDoc OAuth2 login flows due to missing state parameter validation, potentially leading to account takeover.","url":"https://insights.sbomify.com/CVE-2025-66629/"}