icon

We found results for “

CVE-2025-58353

Good to know:

icon

Date: September 4, 2025

Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize user input using regex blacklists such as r"eplace(/javascript:/gi, '')". Because the package uses multi-character tokens and each replacement is applied only once, removing one occurrence can create a new dangerous token due to overlap. The “sanitized” value may still contain an executable payload when used in href/src (or injected into the DOM). There is currently no fix for this issue.

Severity Score

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Incomplete List of Disallowed Inputs

CWE-184

Improper Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/Mathharo/promptcraft-forge-studio.git - null

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us