CVE-2025-3019: Cross-site scripting vulnerabilities in KNIME Business Hub web pages
KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existing data. The issues are caused by a bug https://github.com/Baroshem/nuxt-security/issues/610 in the widely used nuxt-security module.
There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub:
1.13.3 or later
1.12.4 or later
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3019?
CVE-2025-3019 has been classified as a critical vulnerability due to its ability to execute arbitrary JavaScript with user permissions.
How do I fix CVE-2025-3019?
To mitigate CVE-2025-3019, upgrade KNIME Business Hub to version 1.12.5 or 1.13.4 or later, which include security patches.
What are the risks associated with CVE-2025-3019?
Exploiting CVE-2025-3019 could lead to information loss, unauthorized modification of data, and exposure of sensitive user information.
Which versions of KNIME Business Hub are affected by CVE-2025-3019?
CVE-2025-3019 affects KNIME Business Hub versions up to 1.12.4 and from 1.13.3 inclusive.
What type of vulnerability is CVE-2025-3019?
CVE-2025-3019 is classified as a cross-site scripting (XSS) vulnerability.