CVE-2025-59332
Last modified
CVE-2025-59332 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. 3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser function allow users to provide custom attributes that are then appended to the canvas HTML element that is being output by the extension. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser function allow users to provide custom attributes that are then appended to the canvas HTML element that is being output by the extension. The attributes are not sanitized, which means that arbitrary JavaScript can be inserted and executed.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-59332?
How severe is CVE-2025-59332?
How do I fix CVE-2025-59332?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59326CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails…
- CVE-2025-59327In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, b…
- CVE-2025-59328A vulnerability in Apache Fory allows a remote attacker to c…6.5
- CVE-2025-5933The RD Contacto plugin for WordPress is vulnerable to Cross-…4.3
- CVE-2025-59330error-ex allows error subclassing and stack customization. O…8.8
- CVE-2025-59331is-arrayish checks if an object can be used like an Array. O…8.8
- CVE-2025-59333The mcp-database-server (MCP Server) 1.1.0 and earlier, as d…8.1
- CVE-2025-59334Linkr is a lightweight file delivery system that downloads f…8.8
- CVE-2025-59335CubeCart is an ecommerce software solution. Prior to version…7.1
- CVE-2025-59336Luanox is a module host for Lua packages. Prior to 0.1.1, a …6.9
- CVE-2025-59337Discourse is an open-source community discussion platform. I…6.8
- CVE-2025-59339The Bastion provides authentication, authorization, traceabi…4.4
Are you affected by CVE-2025-59332?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST