@dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message

published 2025-11-17 11 mo ago modified 2026-10-18 21 d ago also EUVD-2025-197853 , GHSA-7xvh-c266-cfr5

cvss: 4.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits: 0; none known

@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a "welcome message", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not properly sanitize the HTML, allowing arbitrary JavaScript to be executed. Users with the SYSTEM_CONFIGURATION permission (i.e., administrators), can exploit this weakness to execute arbitrary JavaScript for users browsing to the login page. The issue has been fixed in version 4.13.6.

Patch / fix

fixed in 2 links 3

npm @dependencytrack/frontend 4.13.6
owasp dependency-track_frontend 4.13.6

github.com/DependencyTrack/frontend@8fd757b commit
github.com/DependencyTrack/frontend#1378 pull request
github.com/DependencyTrack/frontend#986 pull request

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 11 mo ago (2025-11-17)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
GitHub	3.1	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	@dependencytrack/frontend	>=4.12.0, <4.13.6	4.13.6

Affected products

DependencyTrack frontend

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary