CVE-2025-58361: falha crítica em MarceloTessaro promptcraft-forge-studio
Promptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVG
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.3%
Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme check that does not protect against XSS. User-controlled URLs pass through src/utils/validation.ts, but the check only strips `javascript:` and a few patterns. `data:` URLs (for example data:image/svg+xml,…) still pass. If a sanitized value is used in href/src, an attacker can execute a script. There is currently no fix for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
MarceloTessaro · promptcraft-forge-studioCVEs relacionadas — MarceloTessaro promptcraft-forge-studio
No mesmo produto, das mais perigosas para as menos.