CVE-2025-46654

Summary

CVE-2025-46654 is a vulnerability affecting CodiMD versions up to 2.2.0. This issue involves a bypass in the Cross-Site Scripting (XSS) protection mechanism, which relies on Content Security Policy (CSP). The vulnerability is exploited by uploading an .html file that references an uploaded .js file, thereby bypassing the CSP-based protection against XSS attacks. Attackers can use this vulnerability to inject malicious scripts into the application, potentially compromising user data or sessions. Users are advised to upgrade to the latest version of CodiMD to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.