CVE-2025-0192
Stored Cross-site Scripting (XSS) in wandb/openui
- State
- Published
- Severity
- 5.4 Medium
- Published
- Mar 20, 2025
- Updated
- Mar 20, 2025
- Reserved
- Jan 3, 2025
Description
A stored Cross-site Scripting (XSS) vulnerability exists in the latest version of wandb/openui. The vulnerability is present in the edit HTML functionality, where an attacker can inject malicious scripts. When the modified HTML is shared with another user, the XSS payload executes, potentially leading to the theft of user prompt history and other sensitive information.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 5.4 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | @huntr_ai |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
wandb/openuiwandb |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.