CVE-2025-49590

CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/www/bounce/main.js#L64-L95
https://github.com/cryptpad/cryptpad/commit/d5e4830ba104a4a442cb23aab5378b8565a95607
https://github.com/cryptpad/cryptpad/security/advisories/GHSA-vq9h-x3gr-v8rj

Configurations

No configuration.

History

23 Jun 2025, 20:16

Type	Values Removed	Values Added
Summary		(es) CryptPad es una suite de colaboración. Antes de la versión 2025.3.0, la función "Link Bouncer" intentaba filtrar las URI de JavaScript para evitar el Cross-Site Scripting (XSS); sin embargo, esto se puede omitir. Existe una ruta de código de "permiso anticipado" que se ejecuta antes de que se verifique el protocolo/esquema de la URI, la cual una URI maliciosa puede seguir. Este problema se ha corregido en la versión 2025.3.0.

18 Jun 2025, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-18 23:15

Updated : 2025-06-23 20:16

NVD link : CVE-2025-49590

Mitre link : CVE-2025-49590

CVE.ORG link : CVE-2025-49590

JSON object : View

Products Affected

No product.

CWE

CWE-692

Incomplete Denylist to Cross-Site Scripting

{"id": "CVE-2025-49590", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-18T23:15:19.200", "references": [{"url": "https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/www/bounce/main.js#L64-L95", "source": "security-advisories@github.com"}, {"url": "https://github.com/cryptpad/cryptpad/commit/d5e4830ba104a4a442cb23aab5378b8565a95607", "source": "security-advisories@github.com"}, {"url": "https://github.com/cryptpad/cryptpad/security/advisories/GHSA-vq9h-x3gr-v8rj", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-692"}]}], "descriptions": [{"lang": "en", "value": "CryptPad is a collaboration suite. Prior to version 2025.3.0, the \"Link Bouncer\" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an \"early allow\" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0."}, {"lang": "es", "value": "CryptPad es una suite de colaboraci\u00f3n. Antes de la versi\u00f3n 2025.3.0, la funci\u00f3n \"Link Bouncer\" intentaba filtrar las URI de JavaScript para evitar el Cross-Site Scripting (XSS); sin embargo, esto se puede omitir. Existe una ruta de c\u00f3digo de \"permiso anticipado\" que se ejecuta antes de que se verifique el protocolo/esquema de la URI, la cual una URI maliciosa puede seguir. Este problema se ha corregido en la versi\u00f3n 2025.3.0."}], "lastModified": "2025-06-23T20:16:59.783", "sourceIdentifier": "security-advisories@github.com"}