CVE-2025-66421: Tryton sao XSS Vulnerability Due to Unescaped Completion Values
Summary
CVE-2025-66421: Tryton sao allows XSS because it does not escape completion values. Affects tryton-sao across 4 version ranges.
< 6.0.69
>= 7.0.0, < 7.0.40
>= 7.1.0, < 7.4.21
>= 7.5.0, < 7.6.11
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tryton sao is a web-based client for the Tryton application server, designed to facilitate the management of business processes. It provides a user-friendly interface for various functionalities, including accounting, inventory management, and project management. The package is built using JavaScript and is part of the broader Tryton ecosystem, which is known for its modular architecture and extensibility. However, it has been identified to have a vulnerability that allows for cross-site scripting (XSS) attacks due to improper handling of completion values.
Vulnerability Detail
The vulnerability in Tryton sao arises from its failure to escape completion values, which can lead to XSS attacks. This issue can be exploited by an attacker to inject malicious scripts into web pages viewed by other users. The lack of proper escaping means that user input is not sanitized, allowing for potential data theft, session hijacking, or defacement of the web application. The vulnerability affects multiple versions of the package, specifically those prior to the patched versions.
How To Fix
Latest published version: 8.2.0 as of 22 Oct 2026
npm install tryton-sao@8.2.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.0.696.0.69npm install tryton-sao@6.0.69 -
>= 7.0.0, < 7.0.407.0.40npm install tryton-sao@7.0.40 -
>= 7.1.0, < 7.4.217.4.21npm install tryton-sao@7.4.21 -
>= 7.5.0, < 7.6.117.6.11npm install tryton-sao@7.6.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the client-side to mitigate the risk of XSS attacks. However, this is not a substitute for updating the package. Ensure that any user-generated content is properly escaped before rendering it in the application.
Conclusion
The Tryton sao package has a critical XSS vulnerability due to unescaped completion values, affecting multiple versions. It is essential to update to the latest patched version to protect your application from potential attacks. Implementing additional input validation can provide temporary relief, but updating is the most effective solution.
See every vulnerability recorded for tryton-sao →
FAQ
The vulnerability is a cross-site scripting (XSS) issue caused by the failure to escape completion values.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
Exploitation of this vulnerability can lead to data theft, session hijacking, and unauthorized actions performed on behalf of users.
While the best solution is to update to a patched version, you can implement input validation and sanitization as a temporary workaround.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for tryton-sao.
