GHSA-q4rg-7cjj-5r86
ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.js
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | express-gateway | <= 1.16.10 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
A cross-site scripting (XSS) issue exists in ExpressGateway up to 1.16.10 in the REST endpoint implemented in lib/rest/routes/users.js. User-controlled input is reflected into the HTTP response without proper sanitization, allowing arbitrary JavaScript execution in the browser of a logged-in user who views the affected page/route. The attack can be triggered over the network with low complexity and requires a low-privileged authenticated context and user interaction (viewing the page). Impact is limited to confidentiality and integrity of the session in the affected UI.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-9095
- https://github.com/freshfish-hust/my-cves/issues/5
- https://github.com/freshfish-hust/my-cves/issues/5#issue-3286622393
- https://github.com/ExpressGateway/express-gateway
- https://vuldb.com/?ctiid.320417
- https://vuldb.com/?id.320417
- https://vuldb.com/?submit.627709