CVE-2025-67712
HTML Injection in Esri ArcGIS Web AppBuilder
Publication date: 2025-12-19
Last updated on: 2025-12-19
Assigner: Environmental Systems Research Institute, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| esri | arcgis_web_appbuilder | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30. It allows a remote, unauthenticated attacker to trick a user into clicking a link that causes arbitrary HTML content to be rendered in the victim's browser. However, there is no evidence that JavaScript can be executed through this vulnerability, which limits its potential impact.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to inject arbitrary HTML into your browser via a crafted link, potentially misleading or confusing users. Since JavaScript execution is not possible, the risk of more severe attacks like cross-site scripting is reduced. However, the injected HTML could still be used for phishing or UI manipulation. Additionally, the affected product is retired and unsupported, so no patches are available for versions prior to 2.30, which is not susceptible.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade ArcGIS Web AppBuilder developer edition to version 2.30 or later, as versions prior to 2.30 are vulnerable. Since the developer edition is retired and unsupported, it is also recommended to migrate to ArcGIS Experience Builder, which is the supported replacement. Avoid using the retired developer edition to prevent exposure to this HTML injection issue. [1]