CVE-2025-64758

MediumCVSS 4.8

Published: 17/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a "welcome message", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not properly sanitize the HTML, allowing arbitrary JavaScript to be executed. Users with the SYSTEM_CONFIGURATION permission (i.e., administrators), can exploit this weakness to execute arbitrary JavaScript for users browsing to the login page.

Risk Assessment

This can lead to XSS attacks against logging-in users, potentially stealing credentials.

Recommendation

Update Dependency-Track to version 4.13.6 or later.

Other vulnerabilities in Dependency-Track

CVE-2025-61776Medium
Dependency-Track prior to version 4.13.5 may send credentials meant for a private NuGet repository to api.nuget.org via the HTTP Authorization header, and may disclose names and versions of components marked as internal. This can happen if the instance contains .NET components, a custom NuGet repository has been configured with authentication credentials, and the repository server does not provide PackageBaseAddress resource in its service index. The issue has been fixed in 4.13.5. Workarounds include disabling custom NuGet repositories until the patch is applied, invalidating previous credentials, and generating new ones.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS