CVE-2025-0192

Description

A stored Cross-site Scripting (XSS) vulnerability exists in the latest version of wandb/openui. The vulnerability is present in the edit HTML functionality, where an attacker can inject malicious scripts. When the modified HTML is shared with another user, the XSS payload executes, potentially leading to the theft of user prompt history and other sensitive information.

Reserved 2025-01-03 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Any version
affected

References

huntr.com/bounties/5f82c722-b674-456a-8691-a6565bf90e39

cve.org (CVE-2025-0192)

nvd.nist.gov (CVE-2025-0192)

Download JSON