CVE-2025-27608: Self Cross-Site Scripting in Arduino IDE
Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting (XSS) vulnerability has been identified within the Arduino-IDE prior to version v2.3.5. The vulnerability occurs in the Additional Board Manager URLs field, which can be found in the Preferences -> Settings section of the Arduino IDE interface. In the vulnerable versions, any values entered in this field are directly displayed to the user through a notification tooltip object, without a proper output encoding routine, due to the underlying ElectronJS engine interpretation. This vulnerability exposes the input parameter to Self-XSS attacks, which may lead to security risks depending on where the malicious payload is injected. This vulnerability is fixed in 2.3.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27608?
CVE-2025-27608 has been classified with a moderate severity due to its potential for exploitation through self cross-site scripting.
How do I fix CVE-2025-27608?
To fix CVE-2025-27608, update your Arduino IDE to version 2.3.5 or later.
What is the impact of CVE-2025-27608?
CVE-2025-27608 can allow an attacker to execute JavaScript code in the context of the user’s session, leading to potential data compromise.
Which versions of Arduino IDE are affected by CVE-2025-27608?
Arduino IDE versions prior to 2.3.5 are affected by CVE-2025-27608.
What mitigation strategies are available for CVE-2025-27608?
The primary mitigation strategy for CVE-2025-27608 is to ensure you are running the latest version of Arduino IDE.