CVE-2025-64758: @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message

November 17, 2025

Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a “welcome message”, which is HTML that is to be rendered on the login page for branding purposes.

When rendering the welcome message, Dependency-Track versions before 4.13.6 did not properly sanitize the HTML, allowing arbitrary JavaScript to be executed.

References

github.com/DependencyTrack/frontend
github.com/DependencyTrack/frontend/pull/1378
github.com/DependencyTrack/frontend/pull/986
github.com/DependencyTrack/frontend/security/advisories/GHSA-7xvh-c266-cfr5
github.com/advisories/GHSA-7xvh-c266-cfr5
nvd.nist.gov/vuln/detail/CVE-2025-64758

Code Behaviors & Features

Detect and mitigate CVE-2025-64758 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →