CVE-2025-58353

Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize user input using regex blacklists such as r`eplace(/javascript:/gi, '')`. Because the package uses multi-character tokens and each replacement is applied only once, removing one occurrence can create a new dangerous token due to overlap. The “sanitized” value may still contain an executable payload when used in href/src (or injected into the DOM). There is currently no fix for this issue.

• CWE-20
• CWE-79
• CWE-184

• https://github.com/MarceloTessaro/promptcraft-forge-studio/security/advisories/GHSA-mv25-7v95-q3pf

Published

Sep 4, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58347An issue was discovered in the Wi-Fi driver in Samsung Mobil…5.5
• CVE-2025-58348An issue was discovered in the Wi-Fi driver in Samsung Mobil…5.5
• CVE-2025-58349An issue was discovered in L2 in Samsung Mobile Processor, W…9.1
• CVE-2025-5835The Droip plugin for WordPress is vulnerable to unauthorized…8.8
• CVE-2025-58351Outline is a service that allows for collaborative documenta…6.8
• CVE-2025-58352Weblate is a web based localization tool. Versions lower tha…6.5
• CVE-2025-58354Kata Containers is an open source project focusing on a stan…6.9
• CVE-2025-58355Soft Serve is a self-hostable Git server for the command lin…7.7
• CVE-2025-58356Constellation is the first Confidential Kubernetes. The Cons…8.3
• CVE-2025-583575ire is a cross-platform desktop artificial intelligence ass…9.6
• CVE-2025-58358Markdownify is a Model Context Protocol server for convertin…7.5
• CVE-2025-58359ZF FROST is a Rust implementation of FROST (Flexible Round-O…6