CVE-2025-46655

Description

CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted JavaScript content, but the selected architecture within AWS does not have components that are able to insert Content-Security-Policy headers.

PUBLISHED Reserved 2025-04-26 | Published 2025-04-26 | Updated 2025-04-29 | Assigner mitre

Problem types

CWE-424 Improper Protection of Alternate Path

Product status

References

github.com/hackmdio/codimd/issues/1910 exploit

github.com/hackmdio/codimd/issues/1910

github.com/...rts/blob/main/formidable/file_upload/report.md

cve.org (CVE-2025-46655)

nvd.nist.gov (CVE-2025-46655)

Download JSON