{"action":"Upgrade @dependencytrack/frontend to 4.13.6 or later.","affected":[{"fixed":"4.13.6","introduced":"4.12.0"}],"component":"@dependencytrack/frontend","cve_ids":["CVE-2025-64758"],"ecosystem":"npm","epss":0.00239,"exploited":false,"fixed_versions":["4.13.6"],"ghsa_id":"GHSA-7xvh-c266-cfr5","id":"tcs_01M5KFB9MCY1ZKG42X8YDPYB22","modified_at":"2025-11-17T18:57:55Z","published_at":"2025-11-17T18:15:55Z","references":["https://osv.dev/vulnerability/GHSA-7xvh-c266-cfr5","https://github.com/DependencyTrack/frontend/security/advisories/GHSA-7xvh-c266-cfr5","https://nvd.nist.gov/vuln/detail/CVE-2025-64758","https://github.com/DependencyTrack/frontend/pull/1378","https://github.com/DependencyTrack/frontend/pull/986","https://github.com/DependencyTrack/frontend/commit/8fd757be612eaf4f35eadbe4c334204d7bd711be","https://github.com/DependencyTrack/frontend"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-7xvh-c266-cfr5","url":"https://osv.dev/vulnerability/GHSA-7xvh-c266-cfr5"}],"summary":"@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message"}