CVE-2025-15454

zhanglun lettura RSS ContentRender.tsx cross site scripting

State: Published
Severity: 2.3 Low
Published: Jan 5, 2026
Updated: Feb 23, 2026
Reserved: Jan 4, 2026

Description

A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender.tsx of the component RSS Handler. The manipulation results in cross site scripting. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used. The patch is identified as 67213093db9923e828a6e3fd8696a998c85da2d4. It is best practice to apply a patch to resolve this issue.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
3.0	3.1 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
letturazhanglun	0.1.0Affected 0.1.1Affected 0.1.2Affected 0.1.3Affected 0.1.4Affected 0.1.5Affected 0.1.6Affected 0.1.7Affected 0.1.8Affected 0.1.9Affected 0.1.10Affected 0.1.11Affected 0.1.12Affected 0.1.13Affected 0.1.14Affected 0.1.15Affected 0.1.16Affected 0.1.17Affected 0.1.18Affected 0.1.19Affected 0.1.20Affected 0.1.21Affected 0.1.22Affected

References

VDB-339487 | zhanglun lettura RSS ContentRender.tsx cross site scriptingvdb-entrytechnical-description
VDB-339487 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #725038 | lettura v0.1.22 XSSthird-party-advisory
https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3related
https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3#proof-of-conceptexploit
https://github.com/zhanglun/lettura/commit/67213093db9923e828a6e3fd8696a998c85da2d4patch
https://github.com/zhanglun/lettura/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.