CVE-2025-66421: XSS
Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/tryton-saoto a version that resolves this vulnerability.Fixed in 6.0.69 - Upgrade
Upgrade
npm/tryton-saoto a version that resolves this vulnerability.Fixed in 7.0.40 - Upgrade
Upgrade
npm/tryton-saoto a version that resolves this vulnerability.Fixed in 7.4.21 - Upgrade
Upgrade
npm/tryton-saoto a version that resolves this vulnerability.Fixed in 7.6.11 - Upgrade
Upgrade
tryton-saoto a version that resolves this vulnerability.Fixed in 7.6.11 - Upgrade
Upgrade
tryton-saoto a version that resolves this vulnerability.Fixed in 7.4.21 - Upgrade
Upgrade
tryton-saoto a version that resolves this vulnerability.Fixed in 7.0.40 - Upgrade
Upgrade
tryton-saoto a version that resolves this vulnerability.Fixed in 6.0.69
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66421?
CVE-2025-66421 is classified as a moderate severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2025-66421?
To fix CVE-2025-66421, update to versions 7.6.11, 7.4.21, 7.0.40, or 6.0.69 of Tryton sao.
Which versions of Tryton sao are affected by CVE-2025-66421?
Versions of Tryton sao before 7.6.11 are affected by CVE-2025-66421.
What type of attack does CVE-2025-66421 allow?
CVE-2025-66421 allows for Cross-Site Scripting (XSS) attacks due to insufficient escaping of completion values.
Is there a recommended upgrade path for CVE-2025-66421?
The recommended upgrade path for CVE-2025-66421 is to upgrade to versions 7.6.11 or later.