CVE-2025-67438: Stored XSS Vulnerability in @sync-in/server Package
Summary
CVE-2025-67438: Sync-in Server has a stored cross-site scripting (XSS) vulnerability. Affects @sync-in/server versions < 1.9.3. Fixed in 1.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @sync-in/server package is a Node.js server designed for real-time synchronization of data across various clients. It facilitates seamless data sharing and collaboration among users. However, prior to version 1.9.3, the package was found to be vulnerable to a stored cross-site scripting (XSS) attack, which could allow malicious users to execute arbitrary JavaScript in the browsers of authenticated users.
Vulnerability Detail
A Stored Cross-Site Scripting (XSS) vulnerability in the @sync-in/server package before version 1.9.3 allows an authenticated attacker to upload a specially crafted SVG file containing malicious JavaScript. This can lead to the execution of arbitrary scripts in the victim's browser, potentially exfiltrating sensitive information such as session cookies. The vulnerability arises from inadequate input validation and sanitization of user-uploaded files.
How To Fix
Latest published version: 2.6.0 as of 23 Oct 2026
npm install @sync-in/server@2.6.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.3
This is the first release that contains the fix.
npm install @sync-in/server@1.9.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement strict validation and sanitization of uploaded files to prevent SVG files from being processed unless they are from trusted sources. Additionally, consider disabling file uploads until the package is updated.
Conclusion
The stored XSS vulnerability in the @sync-in/server package poses a significant risk to applications using versions prior to 1.9.3. It is crucial for developers to update to the latest version to protect against potential attacks. Additionally, implementing proper input validation can help mitigate risks during the transition.
See every vulnerability recorded for @sync-in/server →
FAQ
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected content.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json file for vulnerabilities without requiring any signup.
If left unaddressed, this vulnerability could lead to unauthorized access to sensitive user information, session hijacking, and potential compromise of user accounts.
Yes, implementing strict input validation and sanitization for file uploads can help mitigate the risk until the package is updated.
The CVSS score of this vulnerability is 5.1, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for @sync-in/server.
