CVE-2025-27608

Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting (XSS) vulnerability has been identified within the Arduino-IDE prior to version v2.3.5. The vulnerability occurs in the Additional Board Manager URLs field, which can be found in the Preferences -> Settings section of the Arduino IDE interface. In the vulnerable versions, any values entered in this field are directly displayed to the user through a notification tooltip object, without a proper output encoding routine, due to the underlying ElectronJS engine interpretation. This vulnerability exposes the input parameter to Self-XSS attacks, which may lead to security risks depending on where the malicious payload is injected. This vulnerability is fixed in 2.3.5.

• CWE-79

• https://github.com/arduino/arduino-ide/commit/d298b3ffc94008e89066cd999d891e84190da18f
• https://github.com/arduino/arduino-ide/security/advisories/GHSA-252h-4j5q-88pc

Published

Apr 2, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27601Umbraco is a free and open source .NET content management sy…4.3
• CVE-2025-27602Umbraco is a free and open source .NET content management sy…6.4
• CVE-2025-27603XWiki Confluence Migrator Pro helps admins to import conflue…9.1
• CVE-2025-27604XWiki Confluence Migrator Pro helps admins to import conflue…7.5
• CVE-2025-27606Element Android is an Android Matrix Client provided by Elem…4.6
• CVE-2025-27607Python JSON Logger is a JSON Formatter for Python Logging. B…8.8
• CVE-2025-27609Icinga Web 2 is an open source monitoring web interface, fra…5.4
• CVE-2025-2761GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execut…7.8
• CVE-2025-27610Rack provides an interface for developing web applications i…7.5
• CVE-2025-27611base-x is a base encoder and decoder of any given alphabet u…8.7
• CVE-2025-27612libcontainer is a library for container control. Prior to li…5.9
• CVE-2025-27613Gitk is a Tcl/Tk based Git history browser. Starting with 1.…3.6