CVE-2025-62528
BaseFortify
Publication date: 2025-10-20
Last updated on: 2025-10-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| taguette | taguette | to 1.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a cross-site scripting (XSS) issue in Taguette versions prior to 1.5.0. It occurs because the application does not properly sanitize user input in fields like tag name, tag description, document name, and document description. As a result, a project member can inject JavaScript code that executes when the project is loaded, potentially affecting other users. [2]
How can this vulnerability impact me? :
The vulnerability allows a project member to inject malicious JavaScript code that runs when other users load the project. This can lead to limited data exposure and modification, potentially compromising user data or session information. However, it does not affect system availability or cause denial of service. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your Taguette installation is running a version prior to 1.5.0, as those versions are vulnerable. Additionally, you can inspect project data fields such as tag name, tag description, document name, and document description for injected JavaScript code. Since the vulnerability involves stored cross-site scripting (XSS), manual or automated scanning of these fields for suspicious script tags or JavaScript code can help detect exploitation. Specific commands are not provided in the resources, but you can query your database or export project data and search for patterns like '<script>' or 'javascript:' in these fields. [2, 1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Taguette to version 1.5.0 or later, where the issue has been fixed. This upgrade ensures proper neutralization of user input in the affected fields, preventing JavaScript injection. Additionally, review and sanitize existing project data fields to remove any malicious scripts that may have been injected prior to the upgrade. [2]