CVE-2025-66420
Medium · 5.4CVSS
5.4
EPSS
0.2%
Published
Nov 30, 2025
CISA due date
—
The record
Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tryton-sao | 0 | 6.0.67 |
| npm | tryton-sao | 7.0.0 | 7.0.38 |
| npm | tryton-sao | 7.1.0 | 7.4.19 |
| npm | tryton-sao | 7.5.0 | 7.6.9 |
Related vulnerabilities
- GHSA-xhgv-99mj-8m2x Tryton sao allows XSS via an HTML attachment Same vulnerability
- GHSA-6qj9-2g9m-29x9 Tryton sao allows XSS because it does not escape completion values Also affects tryton-sao
- CVE-2025-66421 Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape… Also affects tryton-sao
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79