CVE-2025-57292: 
NixOS vulnerability analysis and mitigation

CVE-2025-57292 is a stored cross-site scripting (XSS) vulnerability in Todoist version 8484, affecting the avatar upload functionality. The application fails to properly validate MIME types and sanitize image metadata (specifically PNG tEXt chunk Comment fields), allowing attackers to embed and persist malicious JavaScript payloads. It was published on September 26, 2025, and assigned a CVSS v3.1 base score of 6.1 (Medium) (Feedly, PoC - echoBRT).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). An attacker crafts a PNG file with a JavaScript payload injected into the image's metadata Comment field using exiftool, then intercepts the upload request (e.g., via Burp Suite) to change the Content-Type header from image/png to text/html. Because the server does not enforce server-side MIME type verification or strip image metadata, the file is accepted and stored on the CloudFront CDN. When the uploaded avatar is subsequently rendered in a browser, the embedded script executes in the context of other users' sessions (PoC - echoBRT, PoC - ASencerK).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of any Todoist user who views the malicious avatar, which can result in session cookie theft, unauthorized actions performed on behalf of victims, and potential data exfiltration from the Todoist platform. The changed scope (S:C in CVSS) indicates the impact extends beyond the attacker's own session to affect other users. While availability is not directly impacted, the confidentiality and integrity of affected user accounts are at risk (Feedly, PoC - echoBRT).

Two public proof-of-concept repositories are available on GitHub, published by researchers Sencer Kilic and Berat Aksit, demonstrating the full attack chain including the exiftool command and Burp Suite Content-Type override technique (PoC - echoBRT, PoC - ASencerK). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029%, reflecting a low but non-zero probability of exploitation in the near term (Feedly).

1. Craft the malicious PNG: Use exiftool to inject a JavaScript payload into the PNG Comment metadata field:

   exiftool -Comment='">alert(document.cookie)' pngtoxss.png

   This embeds the payload in the PNG's tEXt chunk.

2. Intercept the upload request: Open Todoist in a browser, navigate to the avatar upload feature (e.g., at https://app.todoist.com/app/project/ or https://app.todoist.com/app/task/), and initiate an upload of the crafted PNG while intercepting traffic with Burp Suite.

3. Override the Content-Type: In the intercepted multipart upload request to POST /api/v1/uploads on app.todoist.com, change the inner Content-Type of the file part from image/png to text/html.

4. Forward the request: Send the modified request. The server accepts and stores the file on the CloudFront CDN without proper MIME type validation.

5. Trigger execution: When another authenticated Todoist user views the project or task where the malicious avatar is displayed, the browser renders the file as HTML and executes the embedded JavaScript, achieving stored XSS in the victim's session (PoC - echoBRT, PoC - ASencerK).

• Network: Outbound POST requests to https://app.todoist.com/api/v1/uploads where the file part's Content-Type is text/html rather than an image MIME type; CDN file URLs from d1ysz50cxb9zwl.cloudfront.net serving files with .png extensions but text/html content type.
• File System / CDN: Uploaded avatar files stored on cloudfront.net that contain HTML/JavaScript content despite having image file extensions.
• Logs: Web server or CDN access logs showing requests to avatar/upload endpoints followed by unusual JavaScript execution errors or unexpected outbound connections from victim browsers.
• Browser: Unexpected alert() dialogs, cookie access attempts, or unauthorized API calls originating from Todoist pages when viewing projects or tasks with shared avatars (PoC - echoBRT, PoC - ASencerK).

Doist should apply server-side MIME type validation that inspects actual file content (magic bytes) rather than relying solely on the client-supplied Content-Type header, and strip or sanitize all image metadata before storage. Users and administrators should update Todoist to the latest available version beyond v8484. As a defense-in-depth measure, deploying a strict Content Security Policy (CSP) on the Todoist web application and its CDN can limit the impact of any XSS execution. Organizations should also review file upload mechanisms across the platform for similar weaknesses (Feedly, PoC - echoBRT).

The vulnerability was independently discovered and publicly disclosed by security researchers Sencer Kilic and Berat Aksit, who published two separate GitHub repositories with full proof-of-concept details. No official public statement from Doist (the vendor) has been identified at this time, and broader media or community coverage appears limited (PoC - echoBRT, PoC - ASencerK).