CVE-2025-64758

npm/@dependencytrack/frontend CVE-2025-64758: medium 4.8, EPSS 0.24%

@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message

Action: Upgrade @dependencytrack/frontend to 4.13.6 or later.

npm i @dependencytrack/frontend@4.13.6

Affected

Fixed versions

Sources

• osv: GHSA-7xvh-c266-cfr5
• https://github.com/DependencyTrack/frontend/security/advisories/GHSA-7xvh-c266-cfr5
• https://nvd.nist.gov/vuln/detail/CVE-2025-64758
• https://github.com/DependencyTrack/frontend/pull/1378
• https://github.com/DependencyTrack/frontend/pull/986
• https://github.com/DependencyTrack/frontend/commit/8fd757be612eaf4f35eadbe4c334204d7bd711be
• https://github.com/DependencyTrack/frontend

CVE-2025-64758 · published 2025-11-17T18:15:55Z · modified 2025-11-17T18:57:55Z · JSON