CVE-2025-44091: 
NixOS vulnerability analysis and mitigation

CVE-2025-44091 is a stored Cross-Site Scripting (XSS) vulnerability in yangyouwang crud v1.0.0, affecting the role management function of the application's administrative backend. The vulnerability was published on June 12, 2025, and allows an authenticated attacker with low privileges to inject malicious scripts that execute in other users' browsers. It carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, GitHub PoC).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically a stored XSS variant. The application fails to sanitize or encode user-supplied input in the "role alias" (角色别名) field within the role management function, allowing an attacker to inject arbitrary JavaScript payloads (e.g., alert(document.cookie)) that are persistently stored and later rendered in the browser of any user who views the affected page. Exploitation requires the attacker to be authenticated with at least low-privilege access and requires a victim user to interact with the affected page (GitHub PoC, GitHub Gist).

Successful exploitation allows an attacker to steal session cookies, perform actions on behalf of victim users, modify web page content, or redirect users to malicious sites. Because the payload is stored server-side, any administrator or privileged user who views the role management interface may be affected, potentially enabling privilege escalation or account takeover within the application. Confidentiality and integrity impacts are rated low, and there is no direct availability impact (Feedly, GitHub PoC).

A public proof-of-concept (PoC) is available on GitHub, published by researcher HL4245 on July 2, 2025, demonstrating the stored XSS via the role alias field (GitHub PoC). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Feedly).

1. Reconnaissance: Identify a publicly accessible or network-reachable instance of yangyouwang crud v1.0.0 (source available at https://gitee.com/yangyouwang/crud).
2. Authentication: Log in to the administrative backend using valid credentials (default credentials are admin / 123456 if unchanged).
3. Navigate to role management: Access the role management function within the admin panel.
4. Inject XSS payload: Edit an existing role and insert a malicious JavaScript payload into the role alias (角色别名) field, e.g., <script>alert(document.cookie)</script>.
5. Save the payload: Submit the form to persist the malicious script in the application database.
6. Trigger execution: When any user (including administrators) navigates to the role management page, the stored payload executes in their browser, potentially exposing session cookies or enabling further attacks (GitHub PoC).

• Logs: Web server or application access logs showing POST requests to the role management endpoint containing script tags or encoded JavaScript payloads (e.g., <script>, alert(, document.cookie) in role alias fields.
• Application Data: Database entries in the roles table where the alias/name field contains HTML tags or JavaScript code rather than plain text.
• Network: Outbound HTTP requests from victim browsers to attacker-controlled domains following interaction with the role management page, potentially carrying session token data in query parameters.
• Browser: Unexpected JavaScript alert dialogs or redirects appearing when administrators access the role management interface (GitHub PoC).

No official vendor patch has been publicly announced for yangyouwang crud v1.0.0 at this time. Recommended mitigations include: implementing strict input validation and output encoding on all user-supplied fields (especially the role alias field), deploying a Content Security Policy (CSP) header to restrict inline script execution, setting the HttpOnly flag on session cookies to prevent JavaScript access, and conducting a comprehensive security review of all user-input fields in the application. Organizations should also consider restricting access to the administrative backend to trusted networks only until a patch is available (Feedly).