CVE-2025-66421: XSS
Published Nov 30, 2025
·Updated
Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.
Affected Software
5 affected componentsFixes available
tryton tryton-sao<7.6.11
npm/tryton-sao<6.0.69
6.0.69
npm/tryton-sao>=7.0.0<7.0.40
7.0.40
npm/tryton-sao>=7.1.0<7.4.21
7.4.21
npm/tryton-sao>=7.5.0<7.6.11
7.6.11
Event History
Nov 30, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 AM
DescriptionSeverityWeakness
Advisory Published
via GitHub·03:30 AM
Data Sourced
via GitHub·03:30 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-66421?
CVE-2025-66421 is classified as a moderate severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.
2
How do I fix CVE-2025-66421?
To fix CVE-2025-66421, update to versions 7.6.11, 7.4.21, 7.0.40, or 6.0.69 of Tryton sao.
3
Which versions of Tryton sao are affected by CVE-2025-66421?
Versions of Tryton sao before 7.6.11 are affected by CVE-2025-66421.
4
What type of attack does CVE-2025-66421 allow?
CVE-2025-66421 allows for Cross-Site Scripting (XSS) attacks due to insufficient escaping of completion values.
5
Is there a recommended upgrade path for CVE-2025-66421?
The recommended upgrade path for CVE-2025-66421 is to upgrade to versions 7.6.11 or later.