CVE-2025-46340

{"id": "CVE-2025-46340", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2025-05-05T19:15:56.627", "references": [{"url": "https://github.com/misskey-dev/misskey/commit/d10fdfe9738b17a9d81037c031b40a2cc4cb8038", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-3p2w-xmv5-jm95", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation performed in `UrlPreviewService` and `MkUrlPreview`, it is possible for an attacker to inject arbitrary CSS into the `MkUrlPreview` component. `UrlPreviewService.wrap` falls back to returning the original URL if it's using a protocol that is likely to not be understood by Misskey, IE something other than `http` or `https`. This both can de-anonymize users and_allow further attacks in the client. Additionally, `MkUrlPreview` doesn't escape CSS when applying a `background-image` property, allowing an attacker to craft a URL that applies arbitrary styles to the preview element. Theoretically, an attacker can craft a CSS injection payload to create a fake error message that can deceive the user into giving away their credentials or similar sensitive information. Version 2025.4.1 contains a patch for the issue."}, {"lang": "es", "value": "Misskey es una plataforma de redes sociales federada de c\u00f3digo abierto. A partir de la versi\u00f3n 12.0.0 y anteriores a la 2025.4.1, debido a un descuido en la validaci\u00f3n de `UrlPreviewService` y `MkUrlPreview`, un atacante puede inyectar CSS arbitrario en el componente `MkUrlPreview`. `UrlPreviewService.wrap` recurre a la URL original si utiliza un protocolo que probablemente Misskey no entienda, es decir, algo distinto de `http` o `https`. Esto puede desanonimizar a los usuarios y permitir futuros ataques en el cliente. Adem\u00e1s, `MkUrlPreview` no escapa el CSS al aplicar la propiedad `background-image`, lo que permite a un atacante manipular una URL que aplique estilos arbitrarios al elemento de vista previa. En teor\u00eda, un atacante puede crear un payload de inyecci\u00f3n de CSS para manipular un mensaje de error falso que pueda enga\u00f1ar al usuario para que revele sus credenciales o informaci\u00f3n confidencial similar. La versi\u00f3n 2025.4.1 contiene un parche para el problema."}], "lastModified": "2025-09-03T18:47:53.703", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCAF6218-BAD3-4D8F-9199-A1C786D2B30E", "versionEndExcluding": "2025.4.1", "versionStartIncluding": "12.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}