GHSA-xfp8-x3j6-h67v
ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.js
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | express-gateway | <= 1.16.10 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
A cross-site scripting (XSS) issue exists in ExpressGateway ≤ 1.16.10 in lib/rest/routes/apps.js. User-controlled data returned by the REST endpoint is not sanitized before being rendered by the admin/UI layer, allowing an authenticated, low-privileged actor to store or reflect a payload that executes in a maintainer’s browser when the resource is viewed. The issue can be triggered remotely over the network and does not impact availability. No vendor fix is available at this time.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-9096
- https://github.com/freshfish-hust/my-cves/issues/6
- https://github.com/freshfish-hust/my-cves/issues/6#issue-3287078206
- https://github.com/ExpressGateway/express-gateway
- https://vuldb.com/?ctiid.320418
- https://vuldb.com/?id.320418
- https://vuldb.com/?submit.627833