CVE-2025-64758: @dependencytrack/frontend Persistent Cross-Site Scripting Vulnerability
Summary
CVE-2025-64758: @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message. Affects @dependencytrack/frontend versions >= 4.12.0, < 4.13.6. Fixed in 4.13.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dependency-Track is an open-source platform designed for managing and analyzing software supply chains. It allows users to track vulnerabilities in their dependencies and provides tools for compliance and risk management. The frontend component, @dependencytrack/frontend, is responsible for the user interface, enabling administrators to customize the login experience, including the addition of a welcome message. However, a vulnerability was discovered that affects how this welcome message is rendered, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the improper sanitization of HTML content in the welcome message feature introduced in version 4.12.0. Administrators with the SYSTEM_CONFIGURATION permission can input HTML that is rendered on the login page. In versions prior to 4.13.6, this HTML was not adequately sanitized, allowing attackers to inject arbitrary JavaScript. This could lead to persistent cross-site scripting (XSS) attacks, where malicious scripts are executed in the context of users visiting the login page, potentially compromising user data and session integrity.
How To Fix
Minimum fixed version
4.13.6
This is the first release that contains the fix.
npm install @dependencytrack/frontend@4.13.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, administrators can avoid using HTML in the welcome message until the package is updated. Instead, use plain text to prevent the execution of any scripts.
Conclusion
The vulnerability identified as CVE-2025-64758 in the @dependencytrack/frontend package poses a significant risk due to improper HTML sanitization in the welcome message feature. It is crucial for administrators to update to version 4.13.6 or later to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for @dependencytrack/frontend →
FAQ
The vulnerability is a persistent cross-site scripting (XSS) issue that allows arbitrary JavaScript execution via an unsanitized welcome message.
Users with the SYSTEM_CONFIGURATION permission, typically administrators, are primarily affected as they can configure the welcome message.
If exploited, this vulnerability could allow attackers to execute malicious scripts, potentially compromising user sessions and sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 4.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @dependencytrack/frontend.
