CVE-2025-56313

MediumCVSS 6.1

Published: 30/10/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). An attacker can execute arbitrary JavaScript in a user's browser by including a malicious payload in the "code" URL parameter. When an authenticated admin user accesses the study's URL, the malicious script executes in their browser.

Risk Assessment

This can lead to unauthorized actions, account compromise, and privilege escalation. The risk affects organizations using JATOS in the specified versions.

Recommendation

Update JATOS to a version later than 3.9.6 that fixes the vulnerability. Implement additional input validation and encoding mechanisms.

Other vulnerabilities in JATOS

CVE-2024-55008High
JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system. An attacker can lock a user account by sending 3 failed login attempts per minute, causing permanent account lockout. The lockout is account-based, not IP-based, so any attacker can lock any account.

Original NVD description (English source)

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). This allows remote attackers to execute arbitrary JavaScript in a user's web browser by including a malicious payload in the "code" URL parameter. When an authenticated admin user accesses the study's URL, the malicious script gets interpreted and executes within their browser, which can lead to unauthorized actions, account compromise, and privilege escalation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS