CVE-2025-66420: Tryton sao XSS Vulnerability via HTML Attachments
Summary
CVE-2025-66420: Tryton sao allows XSS via an HTML attachment. Affects tryton-sao across 4 version ranges.
< 6.0.67
>= 7.0.0, < 7.0.38
>= 7.1.0, < 7.4.19
>= 7.5.0, < 7.6.9
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tryton sao is a web-based client for the Tryton application server, designed to facilitate business management tasks. It provides a user-friendly interface for accessing various modules and functionalities of the Tryton framework. However, prior to version 7.6.9, Tryton sao was susceptible to a cross-site scripting (XSS) vulnerability that could be exploited through HTML attachments, posing a risk to users' data integrity and security.
Vulnerability Detail
The vulnerability arises from the handling of HTML attachments within Tryton sao, which allows an attacker to inject malicious scripts. When a user opens an HTML attachment, the script can execute in the context of the user's session, potentially leading to unauthorized actions, data theft, or session hijacking. This issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), making it critical for users to address.
How To Fix
Latest published version: 8.2.0 as of 22 Oct 2026
npm install tryton-sao@8.2.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.0.676.0.67npm install tryton-sao@6.0.67 -
>= 7.0.0, < 7.0.387.0.38npm install tryton-sao@7.0.38 -
>= 7.1.0, < 7.4.197.4.19npm install tryton-sao@7.4.19 -
>= 7.5.0, < 7.6.97.6.9npm install tryton-sao@7.6.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can avoid opening HTML attachments or ensure that they are only opened in a secure environment. Additionally, implementing content security policies (CSP) may help mitigate the risk of XSS attacks.
Conclusion
The XSS vulnerability in Tryton sao allows attackers to exploit HTML attachments, posing a significant risk to users. It is crucial for users to update to the latest patched versions to safeguard their applications against potential exploits. Utilizing tools like Vulert can further enhance security by monitoring dependencies for vulnerabilities.
See every vulnerability recorded for tryton-sao →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of Tryton sao prior to 7.6.9, 7.4.19, 7.0.38, and 6.0.67 are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, or session hijacking, compromising user security.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
Related vulnerabilities
Recent vulnerabilities recorded for tryton-sao.
