CVE-2025-67231

Medium · 5.9

CVSS

5.9

EPSS

0.3%

Published

Jan 23, 2026

CISA due date

—

The record

A reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload.

Affected packages

Ecosystem	Package	Introduced	Fixed