CVE-2025-64744
BaseFortify
Publication date: 2025-11-13
Last updated on: 2025-11-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openobserve | openobserve | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in OpenObserve (up to version 0.16.1) occurs when creating or renaming an organization with HTML content in its name. The HTML markup is rendered inside the invitation email without proper escaping, meaning user-controlled input is directly inserted into the email template. This can lead to unintended HTML rendering in emails.
How can this vulnerability impact me? :
The vulnerability can lead to potential information disclosure or manipulation through the rendering of unescaped HTML in invitation emails. Although the CVSS score indicates low severity with no confidentiality or availability impact, it could allow an attacker to inject malicious HTML content into emails, potentially misleading recipients or causing minor integrity issues.
What immediate steps should I take to mitigate this vulnerability?
Since no patched versions are available, immediate mitigation steps include avoiding creating or renaming organizations with HTML content in their names to prevent injection of unescaped markup into invitation emails. Additionally, review and restrict user input fields to disallow HTML markup until a fix is released.