GHSA-xfp8-x3j6-h67v

ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.js

En bref

Publiée: 2025-08-18 00:30 UTC
Mise à jour: 2025-09-23 20:39 UTC
CVE: CVE-2025-9096
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Description

A cross-site scripting (XSS) issue exists in ExpressGateway ≤ 1.16.10 in lib/rest/routes/apps.js. User-controlled data returned by the REST endpoint is not sanitized before being rendered by the admin/UI layer, allowing an authenticated, low-privileged actor to store or reflect a payload that executes in a maintainer’s browser when the resource is viewed. The issue can be triggered remotely over the network and does not impact availability. No vendor fix is available at this time.

Paquets affectés

Paquet	Versions
npm · express-gateway	introduced 0, last affected 1.16.10

Références

https://nvd.nist.gov/vuln/detail/CVE-2025-9096 ADVISORY
https://github.com/freshfish-hust/my-cves/issues/6 WEB
https://github.com/freshfish-hust/my-cves/issues/6#issue-3287078206 WEB
https://github.com/ExpressGateway/express-gateway PACKAGE
https://vuldb.com/?ctiid.320418 WEB
https://vuldb.com/?id.320418 WEB
https://vuldb.com/?submit.627833 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database