CVE-2025-66421
Medium · 5.4CVSS
5.4
EPSS
0.2%
Published
Nov 30, 2025
CISA due date
—
The record
Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tryton-sao | 0 | 6.0.69 |
| npm | tryton-sao | 7.0.0 | 7.0.40 |
| npm | tryton-sao | 7.1.0 | 7.4.21 |
| npm | tryton-sao | 7.5.0 | 7.6.11 |
Related vulnerabilities
- GHSA-6qj9-2g9m-29x9 Tryton sao allows XSS because it does not escape completion values Same vulnerability
- GHSA-xhgv-99mj-8m2x Tryton sao allows XSS via an HTML attachment Also affects tryton-sao
- CVE-2025-66420 Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. Also affects tryton-sao
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79