CVE-2025-63317

MediumCVSS 5.4

Published: 01/12/2025(UTC)Updated: 04/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files are not sanitized, so embedded JavaScript executes when a user opens the attachment from a task or comment.

Risk Assessment

An attacker can upload a malicious SVG file that, when opened by a victim, executes script in their browser, enabling session theft or actions performed within the application context.

Recommendation

Implement sanitization of uploaded SVG files or block their upload, and serve attachments with secure headers. Update the application to a patched version.

Other vulnerabilities in Todoist

CVE-2025-57292Medium
Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata.

Original NVD description (English source)

Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS