CVE-2025-46655

Summary

CVE-2025-46655 is a vulnerability affecting CodiMD versions up to 2.5.4. The software has a Content Security Policy (CSP) to prevent Cross-Site Scripting (XSS) attacks using JavaScript in uploaded SVG documents. However, this protection can be bypassed when different-origin file storage, like Amazon S3, is employed for hosting untrusted JavaScript content. It's important to note that the use of AWS for hosting untrusted JavaScript may be considered a user error, but the specific architecture within AWS might not support adding Content-Security-Policy headers to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.