CVE-2025-6623

MediumCVSS 4.3

Published: 19/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the victim's browser context.

Risk Assessment

This can lead to redirecting the user to a malicious website or modifying the web page's UI; session hijacking is not possible as session cookies are protected by httpOnly.

Recommendation

Update the carbon console to a version that fixes XML input sanitization.

Other vulnerabilities in carbon console

CVE-2025-12737High
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.

Original NVD description (English source)

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS