CVE-2025-66420: XSS
Published Nov 30, 2025
·Updated
Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.
Affected Software
5 affected componentsFixes available
tryton tryton-sao<7.6.9
npm/tryton-sao<6.0.67
6.0.67
npm/tryton-sao>=7.0.0<7.0.38
7.0.38
npm/tryton-sao>=7.1.0<7.4.19
7.4.19
npm/tryton-sao>=7.5.0<7.6.9
7.6.9
Event History
Nov 30, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 AM
DescriptionSeverityWeakness
Advisory Published
via GitHub·03:30 AM
Data Sourced
via GitHub·03:30 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-66420?
CVE-2025-66420 is classified as a moderate severity XSS vulnerability that affects the Tryton sao prior to version 7.6.9.
2
How do I fix CVE-2025-66420?
To fix CVE-2025-66420, upgrade Tryton sao to version 7.6.9, 7.4.19, 7.0.38, or 6.0.67.
3
What systems are affected by CVE-2025-66420?
CVE-2025-66420 affects all versions of Tryton sao before 7.6.9.
4
What type of vulnerability is CVE-2025-66420?
CVE-2025-66420 is an XSS (Cross-Site Scripting) vulnerability.
5
Can CVE-2025-66420 lead to data leakage?
Yes, CVE-2025-66420 can potentially lead to data leakage due to the exploitation of Cross-Site Scripting.