GHSA-6qj9-2g9m-29x9
Medium · 5.4CVSS
5.4
EPSS
—
Published
Nov 30, 2025
CISA due date
—
The record
Tryton sao allows XSS because it does not escape completion values
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tryton-sao | 0 | 6.0.69 |
| npm | tryton-sao | 7.0.0 | 7.0.40 |
| npm | tryton-sao | 7.1.0 | 7.4.21 |
| npm | tryton-sao | 7.5.0 | 7.6.11 |
Related vulnerabilities
- CVE-2025-66421 Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape… Same vulnerability
- GHSA-xhgv-99mj-8m2x Tryton sao allows XSS via an HTML attachment Also affects tryton-sao
- CVE-2025-66420 Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. Also affects tryton-sao
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79