CVE-2025-31483

Description

Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.

PUBLISHED Reserved 2025-03-28 | Published 2025-04-03 | Updated 2025-04-03 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/...lux/v2/security/advisories/GHSA-cq88-842x-2jhp

github.com/...ommit/cb695e653a08af4cabcb277c271ce74bd0c746e6

cve.org (CVE-2025-31483)

nvd.nist.gov (CVE-2025-31483)

Download JSON