CVE-2025-65621: Snipe-IT is vulnerable to stored cross-site scripting

December 1, 2025 (updated December 4, 2025)

Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator’s session, enabling privilege escalation.

References

github.com/advisories/GHSA-fww5-m9wc-jcjc
github.com/firef0x00/vulnerability-research/tree/main/CVE-2025-65621
github.com/grokability/snipe-it
github.com/grokability/snipe-it/releases/tag/v8.3.4
nvd.nist.gov/vuln/detail/CVE-2025-65621

Code Behaviors & Features

Detect and mitigate CVE-2025-65621 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →