CVE-2025-63317

Description

Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment.

PUBLISHED Reserved 2025-10-27 | Published 2025-12-01 | Updated 2025-12-02 | Assigner mitre

References

github.com/sefabasnak/Todoistv8896

cve.org (CVE-2025-63317)

nvd.nist.gov (CVE-2025-63317)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.