CVE-2025-66420: XSS
Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/tryton-saoto a version that resolves this vulnerability.Fixed in 6.0.67 - Upgrade
Upgrade
npm/tryton-saoto a version that resolves this vulnerability.Fixed in 7.0.38 - Upgrade
Upgrade
npm/tryton-saoto a version that resolves this vulnerability.Fixed in 7.4.19 - Upgrade
Upgrade
npm/tryton-saoto a version that resolves this vulnerability.Fixed in 7.6.9 - Upgrade
Upgrade
tryton-saoto a version that resolves this vulnerability.Fixed in 7.6.9 - Upgrade
Upgrade
tryton-saoto a version that resolves this vulnerability.Fixed in 7.4.19 - Upgrade
Upgrade
tryton-saoto a version that resolves this vulnerability.Fixed in 7.0.38 - Upgrade
Upgrade
tryton-saoto a version that resolves this vulnerability.Fixed in 6.0.67
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66420?
CVE-2025-66420 is classified as a moderate severity XSS vulnerability that affects the Tryton sao prior to version 7.6.9.
How do I fix CVE-2025-66420?
To fix CVE-2025-66420, upgrade Tryton sao to version 7.6.9, 7.4.19, 7.0.38, or 6.0.67.
What systems are affected by CVE-2025-66420?
CVE-2025-66420 affects all versions of Tryton sao before 7.6.9.
What type of vulnerability is CVE-2025-66420?
CVE-2025-66420 is an XSS (Cross-Site Scripting) vulnerability.
Can CVE-2025-66420 lead to data leakage?
Yes, CVE-2025-66420 can potentially lead to data leakage due to the exploitation of Cross-Site Scripting.